Podcasts about XSLT

If you're in SF, join us tomorrow for a fun meetup at CodeGen Night!If you're in NYC, join us for AI Engineer Summit! The Agent Engineering track is now sold out, but 25 tickets remain for AI Leadership and 5 tickets for the workshops. You can see the full schedule of speakers and workshops at https://ai.engineer!It's exceedingly hard to introduce someone like Bret Taylor. We could recite his Wikipedia page, or his extensive work history through Silicon Valley's greatest companies, but everyone else already does that.As a podcast by AI engineers for AI engineers, we had the opportunity to do something a little different. We wanted to dig into what Bret sees from his vantage point at the top of our industry for the last 2 decades, and how that explains the rise of the AI Architect at Sierra, the leading conversational AI/CX platform.“Across our customer base, we are seeing a new role emerge - the role of the AI architect. These leaders are responsible for helping define, manage and evolve their company's AI agent over time. They come from a variety of both technical and business backgrounds, and we think that every company will have one or many AI architects managing their AI agent and related experience.”In our conversation, Bret Taylor confirms the Paul Buchheit legend that he rewrote Google Maps in a weekend, armed with only the help of a then-nascent Google Closure Compiler and no other modern tooling. But what we find remarkable is that he was the PM of Maps, not an engineer, though of course he still identifies as one. We find this theme recurring throughout Bret's career and worldview. We think it is plain as day that AI leadership will have to be hands-on and technical, especially when the ground is shifting as quickly as it is today:“There's a lot of power in combining product and engineering into as few people as possible… few great things have been created by committee.”“If engineering is an order taking organization for product you can sometimes make meaningful things, but rarely will you create extremely well crafted breakthrough products. Those tend to be small teams who deeply understand the customer need that they're solving, who have a maniacal focus on outcomes.”“And I think the reason why is if you look at like software as a service five years ago, maybe you can have a separation of product and engineering because most software as a service created five years ago. I wouldn't say there's like a lot of technological breakthroughs required for most business applications. And if you're making expense reporting software or whatever, it's useful… You kind of know how databases work, how to build auto scaling with your AWS cluster, whatever, you know, it's just, you're just applying best practices to yet another problem. "When you have areas like the early days of mobile development or the early days of interactive web applications, which I think Google Maps and Gmail represent, or now AI agents, you're in this constant conversation with what the requirements of your customers and stakeholders are and all the different people interacting with it and the capabilities of the technology. And it's almost impossible to specify the requirements of a product when you're not sure of the limitations of the technology itself.”This is the first time the difference between technical leadership for “normal” software and for “AI” software was articulated this clearly for us, and we'll be thinking a lot about this going forward. We left a lot of nuggets in the conversation, so we hope you'll just dive in with us (and thank Bret for joining the pod!)Timestamps* 00:00:02 Introductions and Bret Taylor's background* 00:01:23 Bret's experience at Stanford and the dot-com era* 00:04:04 The story of rewriting Google Maps backend* 00:11:06 Early days of interactive web applications at Google* 00:15:26 Discussion on product management and engineering roles* 00:21:00 AI and the future of software development* 00:26:42 Bret's approach to identifying customer needs and building AI companies* 00:32:09 The evolution of business models in the AI era* 00:41:00 The future of programming languages and software development* 00:49:38 Challenges in precisely communicating human intent to machines* 00:56:44 Discussion on Artificial General Intelligence (AGI) and its impact* 01:08:51 The future of agent-to-agent communication* 01:14:03 Bret's involvement in the OpenAI leadership crisis* 01:22:11 OpenAI's relationship with Microsoft* 01:23:23 OpenAI's mission and priorities* 01:27:40 Bret's guiding principles for career choices* 01:29:12 Brief discussion on pasta-making* 01:30:47 How Bret keeps up with AI developments* 01:32:15 Exciting research directions in AI* 01:35:19 Closing remarks and hiring at Sierra Transcript[00:02:05] Introduction and Guest Welcome[00:02:05] Alessio: Hey everyone, welcome to the Latent Space Podcast. This is Alessio, partner and CTO at Decibel Partners, and I'm joined by my co host swyx, founder of smol.ai.[00:02:17] swyx: Hey, and today we're super excited to have Bret Taylor join us. Welcome. Thanks for having me. It's a little unreal to have you in the studio.[00:02:25] swyx: I've read about you so much over the years, like even before. Open AI effectively. I mean, I use Google Maps to get here. So like, thank you for everything that you've done. Like, like your story history, like, you know, I think people can find out what your greatest hits have been.[00:02:40] Bret Taylor's Early Career and Education[00:02:40] swyx: How do you usually like to introduce yourself when, you know, you talk about, you summarize your career, like, how do you look at yourself?[00:02:47] Bret: Yeah, it's a great question. You know, we, before we went on the mics here, we're talking about the audience for this podcast being more engineering. And I do think depending on the audience, I'll introduce myself differently because I've had a lot of [00:03:00] corporate and board roles. I probably self identify as an engineer more than anything else though.[00:03:04] Bret: So even when I was. Salesforce, I was coding on the weekends. So I think of myself as an engineer and then all the roles that I do in my career sort of start with that just because I do feel like engineering is sort of a mindset and how I approach most of my life. So I'm an engineer first and that's how I describe myself.[00:03:24] Bret: You majored in computer[00:03:25] swyx: science, like 1998. And, and I was high[00:03:28] Bret: school, actually my, my college degree was Oh, two undergrad. Oh, three masters. Right. That old.[00:03:33] swyx: Yeah. I mean, no, I was going, I was going like 1998 to 2003, but like engineering wasn't as, wasn't a thing back then. Like we didn't have the title of senior engineer, you know, kind of like, it was just.[00:03:44] swyx: You were a programmer, you were a developer, maybe. What was it like in Stanford? Like, what was that feeling like? You know, was it, were you feeling like on the cusp of a great computer revolution? Or was it just like a niche, you know, interest at the time?[00:03:57] Stanford and the Dot-Com Bubble[00:03:57] Bret: Well, I was at Stanford, as you said, from 1998 to [00:04:00] 2002.[00:04:02] Bret: 1998 was near the peak of the dot com bubble. So. This is back in the day where most people that they're coding in the computer lab, just because there was these sun microsystems, Unix boxes there that most of us had to do our assignments on. And every single day there was a. com like buying pizza for everybody.[00:04:20] Bret: I didn't have to like, I got. Free food, like my first two years of university and then the dot com bubble burst in the middle of my college career. And so by the end there was like tumbleweed going to the job fair, you know, it was like, cause it was hard to describe unless you were there at the time, the like level of hype and being a computer science major at Stanford was like, A thousand opportunities.[00:04:45] Bret: And then, and then when I left, it was like Microsoft, IBM.[00:04:49] Joining Google and Early Projects[00:04:49] Bret: And then the two startups that I applied to were VMware and Google. And I ended up going to Google in large part because a woman named Marissa Meyer, who had been a teaching [00:05:00] assistant when I was, what was called a section leader, which was like a junior teaching assistant kind of for one of the big interest.[00:05:05] Bret: Yes. Classes. She had gone there. And she was recruiting me and I knew her and it was sort of felt safe, you know, like, I don't know. I thought about it much, but it turned out to be a real blessing. I realized like, you know, you always want to think you'd pick Google if given the option, but no one knew at the time.[00:05:20] Bret: And I wonder if I'd graduated in like 1999 where I've been like, mom, I just got a job at pets. com. It's good. But you know, at the end I just didn't have any options. So I was like, do I want to go like make kernel software at VMware? Do I want to go build search at Google? And I chose Google. 50, 50 ball.[00:05:36] Bret: I'm not really a 50, 50 ball. So I feel very fortunate in retrospect that the economy collapsed because in some ways it forced me into like one of the greatest companies of all time, but I kind of lucked into it, I think.[00:05:47] The Google Maps Rewrite Story[00:05:47] Alessio: So the famous story about Google is that you rewrote the Google maps back in, in one week after the map quest quest maps acquisition, what was the story there?[00:05:57] Alessio: Is it. Actually true. Is it [00:06:00] being glorified? Like how, how did that come to be? And is there any detail that maybe Paul hasn't shared before?[00:06:06] Bret: It's largely true, but I'll give the color commentary. So it was actually the front end, not the back end, but it turns out for Google maps, the front end was sort of the hard part just because Google maps was.[00:06:17] Bret: Largely the first ish kind of really interactive web application, say first ish. I think Gmail certainly was though Gmail, probably a lot of people then who weren't engineers probably didn't appreciate its level of interactivity. It was just fast, but. Google maps, because you could drag the map and it was sort of graphical.[00:06:38] Bret: My, it really in the mainstream, I think, was it a map[00:06:41] swyx: quest back then that was, you had the arrows up and down, it[00:06:44] Bret: was up and down arrows. Each map was a single image and you just click left and then wait for a few seconds to the new map to let it was really small too, because generating a big image was kind of expensive on computers that day.[00:06:57] Bret: So Google maps was truly innovative in that [00:07:00] regard. The story on it. There was a small company called where two technologies started by two Danish brothers, Lars and Jens Rasmussen, who are two of my closest friends now. They had made a windows app called expedition, which had beautiful maps. Even in 2000.[00:07:18] Bret: For whenever we acquired or sort of acquired their company, Windows software was not particularly fashionable, but they were really passionate about mapping and we had made a local search product that was kind of middling in terms of popularity, sort of like a yellow page of search product. So we wanted to really go into mapping.[00:07:36] Bret: We'd started working on it. Their small team seemed passionate about it. So we're like, come join us. We can build this together.[00:07:42] Technical Challenges and Innovations[00:07:42] Bret: It turned out to be a great blessing that they had built a windows app because you're less technically constrained when you're doing native code than you are building a web browser, particularly back then when there weren't really interactive web apps and it ended up.[00:07:56] Bret: Changing the level of quality that we [00:08:00] wanted to hit with the app because we were shooting for something that felt like a native windows application. So it was a really good fortune that we sort of, you know, their unusual technical choices turned out to be the greatest blessing. So we spent a lot of time basically saying, how can you make a interactive draggable map in a web browser?[00:08:18] Bret: How do you progressively load, you know, new map tiles, you know, as you're dragging even things like down in the weeds of the browser at the time, most browsers like Internet Explorer, which was dominant at the time would only load two images at a time from the same domain. So we ended up making our map tile servers have like.[00:08:37] Bret: Forty different subdomains so we could load maps and parallels like lots of hacks. I'm happy to go into as much as like[00:08:44] swyx: HTTP connections and stuff.[00:08:46] Bret: They just like, there was just maximum parallelism of two. And so if you had a map, set of map tiles, like eight of them, so So we just, we were down in the weeds of the browser anyway.[00:08:56] Bret: So it was lots of plumbing. I can, I know a lot more about browsers than [00:09:00] most people, but then by the end of it, it was fairly, it was a lot of duct tape on that code. If you've ever done an engineering project where you're not really sure the path from point A to point B, it's almost like. Building a house by building one room at a time.[00:09:14] Bret: The, there's not a lot of architectural cohesion at the end. And then we acquired a company called Keyhole, which became Google earth, which was like that three, it was a native windows app as well, separate app, great app, but with that, we got licenses to all this satellite imagery. And so in August of 2005, we added.[00:09:33] Bret: Satellite imagery to Google Maps, which added even more complexity in the code base. And then we decided we wanted to support Safari. There was no mobile phones yet. So Safari was this like nascent browser on, on the Mac. And it turns out there's like a lot of decisions behind the scenes, sort of inspired by this windows app, like heavy use of XML and XSLT and all these like.[00:09:54] Bret: Technologies that were like briefly fashionable in the early two thousands and everyone hates now for good [00:10:00] reason. And it turns out that all of the XML functionality and Internet Explorer wasn't supporting Safari. So people are like re implementing like XML parsers. And it was just like this like pile of s**t.[00:10:11] Bret: And I had to say a s**t on your part. Yeah, of[00:10:12] Alessio: course.[00:10:13] Bret: So. It went from this like beautifully elegant application that everyone was proud of to something that probably had hundreds of K of JavaScript, which sounds like nothing. Now we're talking like people have modems, you know, not all modems, but it was a big deal.[00:10:29] Bret: So it was like slow. It took a while to load and just, it wasn't like a great code base. Like everything was fragile. So I just got. Super frustrated by it. And then one weekend I did rewrite all of it. And at the time the word JSON hadn't been coined yet too, just to give you a sense. So it's all XML.[00:10:47] swyx: Yeah.[00:10:47] Bret: So we used what is now you would call JSON, but I just said like, let's use eval so that we can parse the data fast. And, and again, that's, it would literally as JSON, but at the time there was no name for it. So we [00:11:00] just said, let's. Pass on JavaScript from the server and eval it. And then somebody just refactored the whole thing.[00:11:05] Bret: And, and it wasn't like I was some genius. It was just like, you know, if you knew everything you wished you had known at the beginning and I knew all the functionality, cause I was the primary, one of the primary authors of the JavaScript. And I just like, I just drank a lot of coffee and just stayed up all weekend.[00:11:22] Bret: And then I, I guess I developed a bit of reputation and no one knew about this for a long time. And then Paul who created Gmail and I ended up starting a company with him too, after all of this told this on a podcast and now it's large, but it's largely true. I did rewrite it and it, my proudest thing.[00:11:38] Bret: And I think JavaScript people appreciate this. Like the un G zipped bundle size for all of Google maps. When I rewrote, it was 20 K G zipped. It was like much smaller for the entire application. It went down by like 10 X. So. What happened on Google? Google is a pretty mainstream company. And so like our usage is shot up because it turns out like it's faster.[00:11:57] Bret: Just being faster is worth a lot of [00:12:00] percentage points of growth at a scale of Google. So how[00:12:03] swyx: much modern tooling did you have? Like test suites no compilers.[00:12:07] Bret: Actually, that's not true. We did it one thing. So I actually think Google, I, you can. Download it. There's a, Google has a closure compiler, a closure compiler.[00:12:15] Bret: I don't know if anyone still uses it. It's gone. Yeah. Yeah. It's sort of gone out of favor. Yeah. Well, even until recently it was better than most JavaScript minifiers because it was more like it did a lot more renaming of variables and things. Most people use ES build now just cause it's fast and closure compilers built on Java and super slow and stuff like that.[00:12:37] Bret: But, so we did have that, that was it. Okay.[00:12:39] The Evolution of Web Applications[00:12:39] Bret: So and that was treated internally, you know, it was a really interesting time at Google at the time because there's a lot of teams working on fairly advanced JavaScript when no one was. So Google suggest, which Kevin Gibbs was the tech lead for, was the first kind of type ahead, autocomplete, I believe in a web browser, and now it's just pervasive in search boxes that you sort of [00:13:00] see a type ahead there.[00:13:01] Bret: I mean, chat, dbt[00:13:01] swyx: just added it. It's kind of like a round trip.[00:13:03] Bret: Totally. No, it's now pervasive as a UI affordance, but that was like Kevin's 20 percent project. And then Gmail, Paul you know, he tells the story better than anyone, but he's like, you know, basically was scratching his own itch, but what was really neat about it is email, because it's such a productivity tool, just needed to be faster.[00:13:21] Bret: So, you know, he was scratching his own itch of just making more stuff work on the client side. And then we, because of Lars and Yen sort of like setting the bar of this windows app or like we need our maps to be draggable. So we ended up. Not only innovate in terms of having a big sync, what would be called a single page application today, but also all the graphical stuff you know, we were crashing Firefox, like it was going out of style because, you know, when you make a document object model with the idea that it's a document and then you layer on some JavaScript and then we're essentially abusing all of this, it just was running into code paths that were not.[00:13:56] Bret: Well, it's rotten, you know, at this time. And so it was [00:14:00] super fun. And, and, you know, in the building you had, so you had compilers, people helping minify JavaScript just practically, but there is a great engineering team. So they were like, that's why Closure Compiler is so good. It was like a. Person who actually knew about programming languages doing it, not just, you know, writing regular expressions.[00:14:17] Bret: And then the team that is now the Chrome team believe, and I, I don't know this for a fact, but I'm pretty sure Google is the main contributor to Firefox for a long time in terms of code. And a lot of browser people were there. So every time we would crash Firefox, we'd like walk up two floors and say like, what the hell is going on here?[00:14:35] Bret: And they would load their browser, like in a debugger. And we could like figure out exactly what was breaking. And you can't change the code, right? Cause it's the browser. It's like slow, right? I mean, slow to update. So, but we could figure out exactly where the bug was and then work around it in our JavaScript.[00:14:52] Bret: So it was just like new territory. Like so super, super fun time, just like a lot of, a lot of great engineers figuring out [00:15:00] new things. And And now, you know, the word, this term is no longer in fashion, but the word Ajax, which was asynchronous JavaScript and XML cause I'm telling you XML, but see the word XML there, to be fair, the way you made HTTP requests from a client to server was this.[00:15:18] Bret: Object called XML HTTP request because Microsoft and making Outlook web access back in the day made this and it turns out to have nothing to do with XML. It's just a way of making HTTP requests because XML was like the fashionable thing. It was like that was the way you, you know, you did it. But the JSON came out of that, you know, and then a lot of the best practices around building JavaScript applications is pre React.[00:15:44] Bret: I think React was probably the big conceptual step forward that we needed. Even my first social network after Google, we used a lot of like HTML injection and. Making real time updates was still very hand coded and it's really neat when you [00:16:00] see conceptual breakthroughs like react because it's, I just love those things where it's like obvious once you see it, but it's so not obvious until you do.[00:16:07] Bret: And actually, well, I'm sure we'll get into AI, but I, I sort of feel like we'll go through that evolution with AI agents as well that I feel like we're missing a lot of the core abstractions that I think in 10 years we'll be like, gosh, how'd you make agents? Before that, you know, but it was kind of that early days of web applications.[00:16:22] swyx: There's a lot of contenders for the reactive jobs of of AI, but no clear winner yet. I would say one thing I was there for, I mean, there's so much we can go into there. You just covered so much.[00:16:32] Product Management and Engineering Synergy[00:16:32] swyx: One thing I just, I just observe is that I think the early Google days had this interesting mix of PM and engineer, which I think you are, you didn't, you didn't wait for PM to tell you these are my, this is my PRD.[00:16:42] swyx: This is my requirements.[00:16:44] mix: Oh,[00:16:44] Bret: okay.[00:16:45] swyx: I wasn't technically a software engineer. I mean,[00:16:48] Bret: by title, obviously. Right, right, right.[00:16:51] swyx: It's like a blend. And I feel like these days, product is its own discipline and its own lore and own industry and engineering is its own thing. And there's this process [00:17:00] that happens and they're kind of separated, but you don't produce as good of a product as if they were the same person.[00:17:06] swyx: And I'm curious, you know, if, if that, if that sort of resonates in, in, in terms of like comparing early Google versus modern startups that you see out there,[00:17:16] Bret: I certainly like wear a lot of hats. So, you know, sort of biased in this, but I really agree that there's a lot of power and combining product design engineering into as few people as possible because, you know few great things have been created by committee, you know, and so.[00:17:33] Bret: If engineering is an order taking organization for product you can sometimes make meaningful things, but rarely will you create extremely well crafted breakthrough products. Those tend to be small teams who deeply understand the customer need that they're solving, who have a. Maniacal focus on outcomes.[00:17:53] Bret: And I think the reason why it's, I think for some areas, if you look at like software as a service five years ago, maybe you can have a [00:18:00] separation of product and engineering because most software as a service created five years ago. I wouldn't say there's like a lot of like. Technological breakthroughs required for most, you know, business applications.[00:18:11] Bret: And if you're making expense reporting software or whatever, it's useful. I don't mean to be dismissive of expense reporting software, but you probably just want to understand like, what are the requirements of the finance department? What are the requirements of an individual file expense report? Okay.[00:18:25] Bret: Go implement that. And you kind of know how web applications are implemented. You kind of know how to. How databases work, how to build auto scaling with your AWS cluster, whatever, you know, it's just, you're just applying best practices to yet another problem when you have areas like the early days of mobile development or the early days of interactive web applications, which I think Google Maps and Gmail represent, or now AI agents, you're in this constant conversation with what the requirements of your customers and stakeholders are and all the different people interacting with it.[00:18:58] Bret: And the capabilities of the [00:19:00] technology. And it's almost impossible to specify the requirements of a product when you're not sure of the limitations of the technology itself. And that's why I use the word conversation. It's not literal. That's sort of funny to use that word in the age of conversational AI.[00:19:15] Bret: You're constantly sort of saying, like, ideally, you could sprinkle some magic AI pixie dust and solve all the world's problems, but it's not the way it works. And it turns out that actually, I'll just give an interesting example.[00:19:26] AI Agents and Modern Tooling[00:19:26] Bret: I think most people listening probably use co pilots to code like Cursor or Devon or Microsoft Copilot or whatever.[00:19:34] Bret: Most of those tools are, they're remarkable. I'm, I couldn't, you know, imagine development without them now, but they're not autonomous yet. Like I wouldn't let it just write most code without my interactively inspecting it. We just are somewhere between it's an amazing co pilot and it's an autonomous software engineer.[00:19:53] Bret: As a product manager, like your aspirations for what the product is are like kind of meaningful. But [00:20:00] if you're a product person, yeah, of course you'd say it should be autonomous. You should click a button and program should come out the other side. The requirements meaningless. Like what matters is like, what is based on the like very nuanced limitations of the technology.[00:20:14] Bret: What is it capable of? And then how do you maximize the leverage? It gives a software engineering team, given those very nuanced trade offs. Coupled with the fact that those nuanced trade offs are changing more rapidly than any technology in my memory, meaning every few months you'll have new models with new capabilities.[00:20:34] Bret: So how do you construct a product that can absorb those new capabilities as rapidly as possible as well? That requires such a combination of technical depth and understanding the customer that you really need more integration. Of product design and engineering. And so I think it's why with these big technology waves, I think startups have a bit of a leg up relative to incumbents because they [00:21:00] tend to be sort of more self actualized in terms of just like bringing those disciplines closer together.[00:21:06] Bret: And in particular, I think entrepreneurs, the proverbial full stack engineers, you know, have a leg up as well because. I think most breakthroughs happen when you have someone who can understand those extremely nuanced technical trade offs, have a vision for a product. And then in the process of building it, have that, as I said, like metaphorical conversation with the technology, right?[00:21:30] Bret: Gosh, I ran into a technical limit that I didn't expect. It's not just like changing that feature. You might need to refactor the whole product based on that. And I think that's, that it's particularly important right now. So I don't, you know, if you, if you're building a big ERP system, probably there's a great reason to have product and engineering.[00:21:51] Bret: I think in general, the disciplines are there for a reason. I think when you're dealing with something as nuanced as the like technologies, like large language models today, there's a ton of [00:22:00] advantage of having. Individuals or organizations that integrate the disciplines more formally.[00:22:05] Alessio: That makes a lot of sense.[00:22:06] Alessio: I've run a lot of engineering teams in the past, and I think the product versus engineering tension has always been more about effort than like whether or not the feature is buildable. But I think, yeah, today you see a lot more of like. Models actually cannot do that. And I think the most interesting thing is on the startup side, people don't yet know where a lot of the AI value is going to accrue.[00:22:26] Alessio: So you have this rush of people building frameworks, building infrastructure, layered things, but we don't really know the shape of the compute. I'm curious that Sierra, like how you thought about building an house, a lot of the tooling for evals or like just, you know, building the agents and all of that.[00:22:41] Alessio: Versus how you see some of the startup opportunities that is maybe still out there.[00:22:46] Bret: We build most of our tooling in house at Sierra, not all. It's, we don't, it's not like not invented here syndrome necessarily, though, maybe slightly guilty of that in some ways, but because we're trying to build a platform [00:23:00] that's in Dorian, you know, we really want to have control over our own destiny.[00:23:03] Bret: And you had made a comment earlier that like. We're still trying to figure out who like the reactive agents are and the jury is still out. I would argue it hasn't been created yet. I don't think the jury is still out to go use that metaphor. We're sort of in the jQuery era of agents, not the react era.[00:23:19] Bret: And, and that's like a throwback for people listening,[00:23:22] swyx: we shouldn't rush it. You know?[00:23:23] Bret: No, yeah, that's my point is. And so. Because we're trying to create an enduring company at Sierra that outlives us, you know, I'm not sure we want to like attach our cart to some like to a horse where it's not clear that like we've figured out and I actually want as a company, we're trying to enable just at a high level and I'll, I'll quickly go back to tech at Sierra, we help consumer brands build customer facing AI agents.[00:23:48] Bret: So. Everyone from Sonos to ADT home security to Sirius XM, you know, if you call them on the phone and AI will pick up with you, you know, chat with them on the Sirius XM homepage. It's an AI agent called Harmony [00:24:00] that they've built on our platform. We're what are the contours of what it means for someone to build an end to end complete customer experience with AI with conversational AI.[00:24:09] Bret: You know, we really want to dive into the deep end of, of all the trade offs to do it. You know, where do you use fine tuning? Where do you string models together? You know, where do you use reasoning? Where do you use generation? How do you use reasoning? How do you express the guardrails of an agentic process?[00:24:25] Bret: How do you impose determinism on a fundamentally non deterministic technology? There's just a lot of really like as an important design space. And I could sit here and tell you, we have the best approach. Every entrepreneur will, you know. But I hope that in two years, we look back at our platform and laugh at how naive we were, because that's the pace of change broadly.[00:24:45] Bret: If you talk about like the startup opportunities, I'm not wholly skeptical of tools companies, but I'm fairly skeptical. There's always an exception for every role, but I believe that certainly there's a big market for [00:25:00] frontier models, but largely for companies with huge CapEx budgets. So. Open AI and Microsoft's Anthropic and Amazon Web Services, Google Cloud XAI, which is very well capitalized now, but I think the, the idea that a company can make money sort of pre training a foundation model is probably not true.[00:25:20] Bret: It's hard to, you're competing with just, you know, unreasonably large CapEx budgets. And I just like the cloud infrastructure market, I think will be largely there. I also really believe in the applications of AI. And I define that not as like building agents or things like that. I define it much more as like, you're actually solving a problem for a business.[00:25:40] Bret: So it's what Harvey is doing in legal profession or what cursor is doing for software engineering or what we're doing for customer experience and customer service. The reason I believe in that is I do think that in the age of AI, what's really interesting about software is it can actually complete a task.[00:25:56] Bret: It can actually do a job, which is very different than the value proposition of [00:26:00] software was to ancient history two years ago. And as a consequence, I think the way you build a solution and For a domain is very different than you would have before, which means that it's not obvious, like the incumbent incumbents have like a leg up, you know, necessarily, they certainly have some advantages, but there's just such a different form factor, you know, for providing a solution and it's just really valuable.[00:26:23] Bret: You know, it's. Like just think of how much money cursor is saving software engineering teams or the alternative, how much revenue it can produce tool making is really challenging. If you look at the cloud market, just as a analog, there are a lot of like interesting tools, companies, you know, Confluent, Monetized Kafka, Snowflake, Hortonworks, you know, there's a, there's a bunch of them.[00:26:48] Bret: A lot of them, you know, have that mix of sort of like like confluence or have the open source or open core or whatever you call it. I, I, I'm not an expert in this area. You know, I do think [00:27:00] that developers are fickle. I think that in the tool space, I probably like. Default towards open source being like the area that will win.[00:27:09] Bret: It's hard to build a company around this and then you end up with companies sort of built around open source to that can work. Don't get me wrong, but I just think that it's nowadays the tools are changing so rapidly that I'm like, not totally skeptical of tool makers, but I just think that open source will broadly win, but I think that the CapEx required for building frontier models is such that it will go to a handful of big companies.[00:27:33] Bret: And then I really believe in agents for specific domains which I think will, it's sort of the analog to software as a service in this new era. You know, it's like, if you just think of the cloud. You can lease a server. It's just a low level primitive, or you can buy an app like you know, Shopify or whatever.[00:27:51] Bret: And most people building a storefront would prefer Shopify over hand rolling their e commerce storefront. I think the same thing will be true of AI. So [00:28:00] I've. I tend to like, if I have a, like an entrepreneur asked me for advice, I'm like, you know, move up the stack as far as you can towards a customer need.[00:28:09] Bret: Broadly, but I, but it doesn't reduce my excitement about what is the reactive building agents kind of thing, just because it is, it is the right question to ask, but I think we'll probably play out probably an open source space more than anything else.[00:28:21] swyx: Yeah, and it's not a priority for you. There's a lot in there.[00:28:24] swyx: I'm kind of curious about your idea maze towards, there are many customer needs. You happen to identify customer experience as yours, but it could equally have been coding assistance or whatever. I think for some, I'm just kind of curious at the top down, how do you look at the world in terms of the potential problem space?[00:28:44] swyx: Because there are many people out there who are very smart and pick the wrong problem.[00:28:47] Bret: Yeah, that's a great question.[00:28:48] Future of Software Development[00:28:48] Bret: By the way, I would love to talk about the future of software, too, because despite the fact it didn't pick coding, I have a lot of that, but I can talk to I can answer your question, though, you know I think when a technology is as [00:29:00] cool as large language models.[00:29:02] Bret: You just see a lot of people starting from the technology and searching for a problem to solve. And I think it's why you see a lot of tools companies, because as a software engineer, you start building an app or a demo and you, you encounter some pain points. You're like,[00:29:17] swyx: a lot of[00:29:17] Bret: people are experiencing the same pain point.[00:29:19] Bret: What if I make it? That it's just very incremental. And you know, I always like to use the metaphor, like you can sell coffee beans, roasted coffee beans. You can add some value. You took coffee beans and you roasted them and roasted coffee beans largely, you know, are priced relative to the cost of the beans.[00:29:39] Bret: Or you can sell a latte and a latte. Is rarely priced directly like as a percentage of coffee bean prices. In fact, if you buy a latte at the airport, it's a captive audience. So it's a really expensive latte. And there's just a lot that goes into like. How much does a latte cost? And I bring it up because there's a supply chain from growing [00:30:00] coffee beans to roasting coffee beans to like, you know, you could make one at home or you could be in the airport and buy one and the margins of the company selling lattes in the airport is a lot higher than the, you know, people roasting the coffee beans and it's because you've actually solved a much more acute human problem in the airport.[00:30:19] Bret: And, and it's just worth a lot more to that person in that moment. It's kind of the way I think about technology too. It sounds funny to liken it to coffee beans, but you're selling tools on top of a large language model yet in some ways your market is big, but you're probably going to like be price compressed just because you're sort of a piece of infrastructure and then you have open source and all these other things competing with you naturally.[00:30:43] Bret: If you go and solve a really big business problem for somebody, that's actually like a meaningful business problem that AI facilitates, they will value it according to the value of that business problem. And so I actually feel like people should just stop. You're like, no, that's, that's [00:31:00] unfair. If you're searching for an idea of people, I, I love people trying things, even if, I mean, most of the, a lot of the greatest ideas have been things no one believed in.[00:31:07] Bret: So I like, if you're passionate about something, go do it. Like who am I to say, yeah, a hundred percent. Or Gmail, like Paul as far, I mean I, some of it's Laura at this point, but like Gmail is Paul's own email for a long time. , and then I amusingly and Paul can't correct me, I'm pretty sure he sent her in a link and like the first comment was like, this is really neat.[00:31:26] Bret: It would be great. It was not your email, but my own . I don't know if it's a true story. I'm pretty sure it's, yeah, I've read that before. So scratch your own niche. Fine. Like it depends on what your goal is. If you wanna do like a venture backed company, if its a. Passion project, f*****g passion, do it like don't listen to anybody.[00:31:41] Bret: In fact, but if you're trying to start, you know an enduring company, solve an important business problem. And I, and I do think that in the world of agents, the software industries has shifted where you're not just helping people more. People be more productive, but you're actually accomplishing tasks autonomously.[00:31:58] Bret: And as a consequence, I think the [00:32:00] addressable market has just greatly expanded just because software can actually do things now and actually accomplish tasks and how much is coding autocomplete worth. A fair amount. How much is the eventual, I'm certain we'll have it, the software agent that actually writes the code and delivers it to you, that's worth a lot.[00:32:20] Bret: And so, you know, I would just maybe look up from the large language models and start thinking about the economy and, you know, think from first principles. I don't wanna get too far afield, but just think about which parts of the economy. We'll benefit most from this intelligence and which parts can absorb it most easily.[00:32:38] Bret: And what would an agent in this space look like? Who's the customer of it is the technology feasible. And I would just start with these business problems more. And I think, you know, the best companies tend to have great engineers who happen to have great insight into a market. And it's that last part that I think some people.[00:32:56] Bret: Whether or not they have, it's like people start so much in the technology, they [00:33:00] lose the forest for the trees a little bit.[00:33:02] Alessio: How do you think about the model of still selling some sort of software versus selling more package labor? I feel like when people are selling the package labor, it's almost more stateless, you know, like it's easier to swap out if you're just putting an input and getting an output.[00:33:16] Alessio: If you think about coding, if there's no ID, you're just putting a prompt and getting back an app. It doesn't really matter. Who generates the app, you know, you have less of a buy in versus the platform you're building, I'm sure on the backend customers have to like put on their documentation and they have, you know, different workflows that they can tie in what's kind of like the line to draw there versus like going full where you're managed customer support team as a service outsource versus.[00:33:40] Alessio: This is the Sierra platform that you can build on. What was that decision? I'll sort of[00:33:44] Bret: like decouple the question in some ways, which is when you have something that's an agent, who is the person using it and what do they want to do with it? So let's just take your coding agent for a second. I will talk about Sierra as well.[00:33:59] Bret: Who's the [00:34:00] customer of a, an agent that actually produces software? Is it a software engineering manager? Is it a software engineer? And it's there, you know, intern so to speak. I don't know. I mean, we'll figure this out over the next few years. Like what is that? And is it generating code that you then review?[00:34:16] Bret: Is it generating code with a set of unit tests that pass, what is the actual. For lack of a better word contract, like, how do you know that it did what you wanted it to do? And then I would say like the product and the pricing, the packaging model sort of emerged from that. And I don't think the world's figured out.[00:34:33] Bret: I think it'll be different for every agent. You know, in our customer base, we do what's called outcome based pricing. So essentially every time the AI agent. Solves the problem or saves a customer or whatever it might be. There's a pre negotiated rate for that. We do that. Cause it's, we think that that's sort of the correct way agents, you know, should be packaged.[00:34:53] Bret: I look back at the history of like cloud software and notably the introduction of the browser, which led to [00:35:00] software being delivered in a browser, like Salesforce to. Famously invented sort of software as a service, which is both a technical delivery model through the browser, but also a business model, which is you subscribe to it rather than pay for a perpetual license.[00:35:13] Bret: Those two things are somewhat orthogonal, but not really. If you think about the idea of software running in a browser, that's hosted. Data center that you don't own, you sort of needed to change the business model because you don't, you can't really buy a perpetual license or something otherwise like, how do you afford making changes to it?[00:35:31] Bret: So it only worked when you were buying like a new version every year or whatever. So to some degree, but then the business model shift actually changed business as we know it, because now like. Things like Adobe Photoshop. Now you subscribe to rather than purchase. So it ended up where you had a technical shift and a business model shift that were very logically intertwined that actually the business model shift was turned out to be as significant as the technical as the shift.[00:35:59] Bret: And I think with [00:36:00] agents, because they actually accomplish a job, I do think that it doesn't make sense to me that you'd pay for the privilege of like. Using the software like that coding agent, like if it writes really bad code, like fire it, you know, I don't know what the right metaphor is like you should pay for a job.[00:36:17] Bret: Well done in my opinion. I mean, that's how you pay your software engineers, right? And[00:36:20] swyx: and well, not really. We paid to put them on salary and give them options and they vest over time. That's fair.[00:36:26] Bret: But my point is that you don't pay them for how many characters they write, which is sort of the token based, you know, whatever, like, There's a, that famous Apple story where we're like asking for a report of how many lines of code you wrote.[00:36:40] Bret: And one of the engineers showed up with like a negative number cause he had just like done a big refactoring. There was like a big F you to management who didn't understand how software is written. You know, my sense is like the traditional usage based or seat based thing. It's just going to look really antiquated.[00:36:55] Bret: Cause it's like asking your software engineer, how many lines of code did you write today? Like who cares? Like, cause [00:37:00] absolutely no correlation. So my old view is I don't think it's be different in every category, but I do think that that is the, if an agent is doing a job, you should, I think it properly incentivizes the maker of that agent and the customer of, of your pain for the job well done.[00:37:16] Bret: It's not always perfect to measure. It's hard to measure engineering productivity, but you can, you should do something other than how many keys you typed, you know Talk about perverse incentives for AI, right? Like I can write really long functions to do the same thing, right? So broadly speaking, you know, I do think that we're going to see a change in business models of software towards outcomes.[00:37:36] Bret: And I think you'll see a change in delivery models too. And, and, you know, in our customer base you know, we empower our customers to really have their hands on the steering wheel of what the agent does they, they want and need that. But the role is different. You know, at a lot of our customers, the customer experience operations folks have renamed themselves the AI architects, which I think is really cool.[00:37:55] Bret: And, you know, it's like in the early days of the Internet, there's the role of the webmaster. [00:38:00] And I don't know whether your webmaster is not a fashionable, you know, Term, nor is it a job anymore? I just, I don't know. Will they, our tech stand the test of time? Maybe, maybe not. But I do think that again, I like, you know, because everyone listening right now is a software engineer.[00:38:14] Bret: Like what is the form factor of a coding agent? And actually I'll, I'll take a breath. Cause actually I have a bunch of pins on them. Like I wrote a blog post right before Christmas, just on the future of software development. And one of the things that's interesting is like, if you look at the way I use cursor today, as an example, it's inside of.[00:38:31] Bret: A repackaged visual studio code environment. I sometimes use the sort of agentic parts of it, but it's largely, you know, I've sort of gotten a good routine of making it auto complete code in the way I want through tuning it properly when it actually can write. I do wonder what like the future of development environments will look like.[00:38:55] Bret: And to your point on what is a software product, I think it's going to change a lot in [00:39:00] ways that will surprise us. But I always use, I use the metaphor in my blog post of, have you all driven around in a way, Mo around here? Yeah, everyone has. And there are these Jaguars, the really nice cars, but it's funny because it still has a steering wheel, even though there's no one sitting there and the steering wheels like turning and stuff clearly in the future.[00:39:16] Bret: If once we get to that, be more ubiquitous, like why have the steering wheel and also why have all the seats facing forward? Maybe just for car sickness. I don't know, but you could totally rearrange the car. I mean, so much of the car is oriented around the driver, so. It stands to reason to me that like, well, autonomous agents for software engineering run through visual studio code.[00:39:37] Bret: That seems a little bit silly because having a single source code file open one at a time is kind of a goofy form factor for when like the code isn't being written primarily by you, but it begs the question of what's your relationship with that agent. And I think the same is true in our industry of customer experience, which is like.[00:39:55] Bret: Who are the people managing this agent? What are the tools do they need? And they definitely need [00:40:00] tools, but it's probably pretty different than the tools we had before. It's certainly different than training a contact center team. And as software engineers, I think that I would like to see particularly like on the passion project side or research side.[00:40:14] Bret: More innovation in programming languages. I think that we're bringing the cost of writing code down to zero. So the fact that we're still writing Python with AI cracks me up just cause it's like literally was designed to be ergonomic to write, not safe to run or fast to run. I would love to see more innovation and how we verify program correctness.[00:40:37] Bret: I studied for formal verification in college a little bit and. It's not very fashionable because it's really like tedious and slow and doesn't work very well. If a lot of code is being written by a machine, you know, one of the primary values we can provide is verifying that it actually does what we intend that it does.[00:40:56] Bret: I think there should be lots of interesting things in the software development life cycle, like how [00:41:00] we think of testing and everything else, because. If you think about if we have to manually read every line of code that's coming out as machines, it will just rate limit how much the machines can do. The alternative is totally unsafe.[00:41:13] Bret: So I wouldn't want to put code in production that didn't go through proper code review and inspection. So my whole view is like, I actually think there's like an AI native I don't think the coding agents don't work well enough to do this yet, but once they do, what is sort of an AI native software development life cycle and how do you actually.[00:41:31] Bret: Enable the creators of software to produce the highest quality, most robust, fastest software and know that it's correct. And I think that's an incredible opportunity. I mean, how much C code can we rewrite and rust and make it safe so that there's fewer security vulnerabilities. Can we like have more efficient, safer code than ever before?[00:41:53] Bret: And can you have someone who's like that guy in the matrix, you know, like staring at the little green things, like where could you have an operator [00:42:00] of a code generating machine be like superhuman? I think that's a cool vision. And I think too many people are focused on like. Autocomplete, you know, right now, I'm not, I'm not even, I'm guilty as charged.[00:42:10] Bret: I guess in some ways, but I just like, I'd like to see some bolder ideas. And that's why when you were joking, you know, talking about what's the react of whatever, I think we're clearly in a local maximum, you know, metaphor, like sort of conceptual local maximum, obviously it's moving really fast. I think we're moving out of it.[00:42:26] Alessio: Yeah. At the end of 23, I've read this blog post from syntax to semantics. Like if you think about Python. It's taking C and making it more semantic and LLMs are like the ultimate semantic program, right? You can just talk to them and they can generate any type of syntax from your language. But again, the languages that they have to use were made for us, not for them.[00:42:46] Alessio: But the problem is like, as long as you will ever need a human to intervene, you cannot change the language under it. You know what I mean? So I'm curious at what point of automation we'll need to get, we're going to be okay making changes. To the underlying languages, [00:43:00] like the programming languages versus just saying, Hey, you just got to write Python because I understand Python and I'm more important at the end of the day than the model.[00:43:08] Alessio: But I think that will change, but I don't know if it's like two years or five years. I think it's more nuanced actually.[00:43:13] Bret: So I think there's a, some of the more interesting programming languages bring semantics into syntax. So let me, that's a little reductive, but like Rust as an example, Rust is memory safe.[00:43:25] Bret: Statically, and that was a really interesting conceptual, but it's why it's hard to write rust. It's why most people write python instead of rust. I think rust programs are safer and faster than python, probably slower to compile. But like broadly speaking, like given the option, if you didn't have to care about the labor that went into it.[00:43:45] Bret: You should prefer a program written in Rust over a program written in Python, just because it will run more efficiently. It's almost certainly safer, et cetera, et cetera, depending on how you define safe, but most people don't write Rust because it's kind of a pain in the ass. And [00:44:00] the audience of people who can is smaller, but it's sort of better in most, most ways.[00:44:05] Bret: And again, let's say you're making a web service and you didn't have to care about how hard it was to write. If you just got the output of the web service, the rest one would be cheaper to operate. It's certainly cheaper and probably more correct just because there's so much in the static analysis implied by the rest programming language that it probably will have fewer runtime errors and things like that as well.[00:44:25] Bret: So I just give that as an example, because so rust, at least my understanding that came out of the Mozilla team, because. There's lots of security vulnerabilities in the browser and it needs to be really fast. They said, okay, we want to put more of a burden at the authorship time to have fewer issues at runtime.[00:44:43] Bret: And we need the constraint that it has to be done statically because browsers need to be really fast. My sense is if you just think about like the, the needs of a programming language today, where the role of a software engineer is [00:45:00] to use an AI to generate functionality and audit that it does in fact work as intended, maybe functionally, maybe from like a correctness standpoint, some combination thereof, how would you create a programming system that facilitated that?[00:45:15] Bret: And, you know, I bring up Rust is because I think it's a good example of like, I think given a choice of writing in C or Rust, you should choose Rust today. I think most people would say that, even C aficionados, just because. C is largely less safe for very similar, you know, trade offs, you know, for the, the system and now with AI, it's like, okay, well, that just changes the game on writing these things.[00:45:36] Bret: And so like, I just wonder if a combination of programming languages that are more structurally oriented towards the values that we need from an AI generated program, verifiable correctness and all of that. If it's tedious to produce for a person, that maybe doesn't matter. But one thing, like if I asked you, is this rest program memory safe?[00:45:58] Bret: You wouldn't have to read it, you just have [00:46:00] to compile it. So that's interesting. I mean, that's like an, that's one example of a very modest form of formal verification. So I bring that up because I do think you have AI inspect AI, you can have AI reviewed. Do AI code reviews. It would disappoint me if the best we could get was AI reviewing Python and having scaled a few very large.[00:46:21] Bret: Websites that were written on Python. It's just like, you know, expensive and it's like every, trust me, every team who's written a big web service in Python has experimented with like Pi Pi and all these things just to make it slightly more efficient than it naturally is. You don't really have true multi threading anyway.[00:46:36] Bret: It's just like clearly that you do it just because it's convenient to write. And I just feel like we're, I don't want to say it's insane. I just mean. I do think we're at a local maximum. And I would hope that we create a programming system, a combination of programming languages, formal verification, testing, automated code reviews, where you can use AI to generate software in a high scale way and trust it.[00:46:59] Bret: And you're [00:47:00] not limited by your ability to read it necessarily. I don't know exactly what form that would take, but I feel like that would be a pretty cool world to live in.[00:47:08] Alessio: Yeah. We had Chris Lanner on the podcast. He's doing great work with modular. I mean, I love. LVM. Yeah. Basically merging rust in and Python.[00:47:15] Alessio: That's kind of the idea. Should be, but I'm curious is like, for them a big use case was like making it compatible with Python, same APIs so that Python developers could use it. Yeah. And so I, I wonder at what point, well, yeah.[00:47:26] Bret: At least my understanding is they're targeting the data science Yeah. Machine learning crowd, which is all written in Python, so still feels like a local maximum.[00:47:34] Bret: Yeah.[00:47:34] swyx: Yeah, exactly. I'll force you to make a prediction. You know, Python's roughly 30 years old. In 30 years from now, is Rust going to be bigger than Python?[00:47:42] Bret: I don't know this, but just, I don't even know this is a prediction. I just am sort of like saying stuff I hope is true. I would like to see an AI native programming language and programming system, and I use language because I'm not sure language is even the right thing, but I hope in 30 years, there's an AI native way we make [00:48:00] software that is wholly uncorrelated with the current set of programming languages.[00:48:04] Bret: or not uncorrelated, but I think most programming languages today were designed to be efficiently authored by people and some have different trade offs.[00:48:15] Evolution of Programming Languages[00:48:15] Bret: You know, you have Haskell and others that were designed for abstractions for parallelism and things like that. You have programming languages like Python, which are designed to be very easily written, sort of like Perl and Python lineage, which is why data scientists use it.[00:48:31] Bret: It's it can, it has a. Interactive mode, things like that. And I love, I'm a huge Python fan. So despite all my Python trash talk, a huge Python fan wrote at least two of my three companies were exclusively written in Python and then C came out of the birth of Unix and it wasn't the first, but certainly the most prominent first step after assembly language, right?[00:48:54] Bret: Where you had higher level abstractions rather than and going beyond go to, to like abstractions, [00:49:00] like the for loop and the while loop.[00:49:01] The Future of Software Engineering[00:49:01] Bret: So I just think that if the act of writing code is no longer a meaningful human exercise, maybe it will be, I don't know. I'm just saying it sort of feels like maybe it's one of those parts of history that just will sort of like go away, but there's still the role of this offer engineer, like the person actually building the system.[00:49:20] Bret: Right. And. What does a programming system for that form factor look like?[00:49:25] React and Front-End Development[00:49:25] Bret: And I, I just have a, I hope to be just like I mentioned, I remember I was at Facebook in the very early days when, when, what is now react was being created. And I remember when the, it was like released open source I had left by that time and I was just like, this is so f*****g cool.[00:49:42] Bret: Like, you know, to basically model your app independent of the data flowing through it, just made everything easier. And then now. You know, I can create, like there's a lot of the front end software gym play is like a little chaotic for me, to be honest with you. It is like, it's sort of like [00:50:00] abstraction soup right now for me, but like some of those core ideas felt really ergonomic.[00:50:04] Bret: I just wanna, I'm just looking forward to the day when someone comes up with a programming system that feels both really like an aha moment, but completely foreign to me at the same time. Because they created it with sort of like from first principles recognizing that like. Authoring code in an editor is maybe not like the primary like reason why a programming system exists anymore.[00:50:26] Bret: And I think that's like, that would be a very exciting day for me.[00:50:28] The Role of AI in Programming[00:50:28] swyx: Yeah, I would say like the various versions of this discussion have happened at the end of the day, you still need to precisely communicate what you want. As a manager of people, as someone who has done many, many legal contracts, you know how hard that is.[00:50:42] swyx: And then now we have to talk to machines doing that and AIs interpreting what we mean and reading our minds effectively. I don't know how to get across that barrier of translating human intent to instructions. And yes, it can be more declarative, but I don't know if it'll ever Crossover from being [00:51:00] a programming language to something more than that.[00:51:02] Bret: I agree with you. And I actually do think if you look at like a legal contract, you know, the imprecision of the English language, it's like a flaw in the system. How many[00:51:12] swyx: holes there are.[00:51:13] Bret: And I do think that when you're making a mission critical software system, I don't think it should be English language prompts.[00:51:19] Bret: I think that is silly because you want the precision of a a programming language. My point was less about that and more about if the actual act of authoring it, like if you.[00:51:32] Formal Verification in Software[00:51:32] Bret: I'll think of some embedded systems do use formal verification. I know it's very common in like security protocols now so that you can, because the importance of correctness is so great.[00:51:41] Bret: My intellectual exercise is like, why not do that for all software? I mean, probably that's silly just literally to do what we literally do for. These low level security protocols, but the only reason we don't is because it's hard and tedious and hard and tedious are no longer factors. So, like, if I could, I mean, [00:52:00] just think of, like, the silliest app on your phone right now, the idea that that app should be, like, formally verified for its correctness feels laughable right now because, like, God, why would you spend the time on it?[00:52:10] Bret: But if it's zero costs, like, yeah, I guess so. I mean, it never crashed. That's probably good. You know, why not? I just want to, like, set our bars really high. Like. We should make, software has been amazing. Like there's a Mark Andreessen blog post, software is eating the world. And you know, our whole life is, is mediated digitally.[00:52:26] Bret: And that's just increasing with AI. And now we'll have our personal agents talking to the agents on the CRO platform and it's agents all the way down, you know, our core infrastructure is running on these digital systems. We now have like, and we've had a shortage of software developers for my entire life.[00:52:45] Bret: And as a consequence, you know if you look, remember like health care, got healthcare. gov that fiasco security vulnerabilities leading to state actors getting access to critical infrastructure. I'm like. We now have like created this like amazing system that can [00:53:00] like, we can fix this, you know, and I, I just want to, I'm both excited about the productivity gains in the economy, but I just think as software engineers, we should be bolder.[00:53:08] Bret: Like we should have aspirations to fix these systems so that like in general, as you said, as precise as we want to be in the specification of the system. We can make it work correctly now, and I'm being a little bit hand wavy, and I think we need some systems. I think that's where we should set the bar, especially when so much of our life depends on this critical digital infrastructure.[00:53:28] Bret: So I'm I'm just like super optimistic about it. But actually, let's go to w

An airhacks.fm conversation with Phillip Krueger (@phillipkruger) about: early programming experiences with Visual Basic and Java, transition from actuarial science to computer science, first job at a bank working with Java Swing and RMI over CORBA, experience with J2EE and XML technologies, working with XML and XSLT, development of open-source Swing components, work on dotMobi sites for mobile phones in Africa, creation of API extensions for Java EE and MicroProfile, involvement in the MicroProfile GraphQL specification, joining Red Hat and working on quarkus, development of SmallRye GraphQL, improvements to OpenAPI support in Quarkus, work on Quarkus Dev UI, discussion about the evolution of Java application servers and frameworks, comparison of REST and GraphQL, thoughts on Java development culture in South Africa Phillip Krueger on twitter: @phillipkruger

Episode 52: In this episode of Critical Thinking - Bug Bounty Podcast we're going back and highlighting some of the best technical moments from the past year! Hope you enjoy this best of 2023 Supercut!Follow us on twitter at: @ctbbpodcastWe're new to this podcasting thing, so feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:https://twitter.com/0xteknogeekhttps://twitter.com/rhynorater------ Ways to Support CTBBPodcast ------Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.Timestamps:(00:00:00) Introduction(00:02:55) Episode 26: Meta tags and base tags in HTML(00:15:20) Episode 27: Client-side path traversal(00:23:18) Episode 27: Cookie bombing + cookie jar overflow(00:35:47) Episode 44: Cross environment authentication bugs(00:43:17) Episode 47: The open-faced Iframe Sandwich(00:50:19) Episode 47: js hoisting and classic Joel nerdsnipe(00:58:28) Episode 29: Sean Yeoh on Subdomains vs IP in recon(01:04:05) Episode 30: Shubs on reversing enterprise software(01:24:58) Episode 30: Shubs on building out a recon flow(01:29:36) Episode 30: Shubs on Hacking IIS Servers(01:36:45) Episode 37: 0xLupin on smart JavaScript analysis tools(01:45:42) Episode 45: Frans Rosen On App cache, Service workers cookie stuffing, and postMessage(02:15:02) Episode 50: Mathias Karlsson on XSLT and MXSS(02:39:26) Episode 27: Assetnote's sharefile RCE(02:48:18) Episode 31: Perforce RCE(02:53:48) Episode 48: Sam Erb's XSLT bug story(02:58:47) Final thoughts and Special Thanks

Episode 50: In this episode of Critical Thinking - Bug Bounty Podcast, Justin catches up with hacking master Mathias Karlsson, and talks about burnout, collaboration, and the importance of specialization. Then we dive into the technical details of MXSS and XSLT, character encoding, and give some predictions of what Bug Bounty might look like in the future…Follow us on twitter at: @ctbbpodcastSend us any feedback here: info@criticalthinkingpodcast.ioShoutout to YTCracker for the awesome intro music!------ Links ------Follow your hosts Rhynorater & Teknogeek on twitter:------ Ways to Support CTBBPodcast ------Sign up for Caido using the referral code CTBBPODCAST for a 10% discount.Hop on the CTBB Discord!We also do Discord subs at $25, $10, $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.Today's GuestEpisode ResourcesHow to Differentiate Yourself as a HunterMutateMethodshackaplanetenArticle About Unicode and Character SetsByte Order Mark:Character EncodingsShapeCatcherWAF BypassBountyDashEXPLOITING HTTP'S HIDDEN ATTACK-SURFACETimestamps:(00:00:00) Introduction(00:10:06) Automation Setup and Assetnote Origins(00:16:49) Sharing Tips, and Content Creation(00:22:27) Collaboration and Optimization(00:36:44) Working at Detectify(00:51:45) Bug Bounty Burnout(00:56:15) Early Days of Bug Bounty and Future Predictions(01:19:00) Nerdsnipeability(01:29:38) MXSS and XSLT(01:54:20) Learning through being wrong(02:00:15) Go-to Vulns

Twitter Agarri: https://twitter.com/Agarri_FR Formation Burp Suite: https://hackademy.agarri.fr/ Twitter MasteringBurp : https://twitter.com/MasteringBurp Blog Agarri : https://www.agarri.fr/fr mpgn: ⁠⁠https://twitter.com/mpgn_x64⁠⁠

2022-10-18 Weekly News - Episode 168Watch the video version on YouTube at https://youtu.be/SgTjYDH0N6M Hosts:  Brad Wood - Senior Developer at Ortus Solutions Gavin Pickin - Senior Developer at Ortus Solutions Thanks to our Sponsor - Ortus SolutionsThe makers of ColdBox, CommandBox, ForgeBox, TestBox and all your favorite box-es out there. A few ways  to say thanks back to Ortus Solutions: Like and subscribe to our videos on YouTube.  Help ORTUS reach for the Stars - Star and Fork our Repos Star all of your Github Box Dependencies from CommandBox with https://www.forgebox.io/view/commandbox-github  Subscribe to our Podcast on your Podcast Apps and leave us a review Sign up for a free or paid account on CFCasts, which is releasing new content every week BOXLife store: https://www.ortussolutions.com/about-us/shop Buy Ortus's Book - 102 ColdBox HMVC Quick Tips and Tricks on GumRoad (http://gum.co/coldbox-tips)  Patreon Support ( effervescent )Goal 1 - We have 42 patreons providing 100% of the funding for our Modernize or Die Podcasts via our Patreon site: https://www.patreon.com/ortussolutions. Goal 2 - We are 33% of the way to fully fund the hosting of ForgeBox.io News and AnnouncementsUpdate - Trying out Github Co-PilotI know Adam Tuttle, Carol Hamilton, Adam Cameron are using Co-Pilot, so I thought I would try it out. It's interesting, it's not very CF Smart yet, but it does give you some great pseudo code, especially with our testing.https://github.com/features/copilot Hacktoberfest 2023HERE'S WHAT YOU NEED TO KNOW TO PARTICIPATE AND COMPLETE HACKTOBERFEST:Register anytime between September 26 and October 31Pull requests can be made in any GITHUB or GITLAB hosted project that's participating in Hacktoberfest (look for the “hacktoberfest” topic)Project maintainers must accept your pull/merge requests for them to count toward your totalHave 4 pull/merge requests accepted between October 1 and October 31 to complete HacktoberfestThe first 40,000 participants (maintainers and contributors) who complete Hacktoberfest can elect to receive one of two prizes: a tree planted in their name, or the Hacktoberfest 2022 t-shirt.https://hacktoberfest.com/ Ortus Blog about Hacktoberfest - https://www.ortussolutions.com/blog/october-is-here-and-that-means-hacktoberfest New Releases and UpdatesColdFusion 2021 "refreshed" installers available (with update 5)...but only in one place for nowHere's some surprising news: Adobe has released a "refreshed" installer for CF2021, which includes update 5 (which came out last week) built-in.TLDR: these new "refreshed" CF2021 installers are (for now) available only here: here.https://www.carehart.org/blog/2022/10/17/cf2021_refreshed_installers_available_but_only_one_place_for_now Spreadsheet-CFML v3.6.1Spreadsheet-CFML v3.6.0 released with new support for adding data validation drop-downs #cfmlhttps://github.com/cfsimplicity/spreadsheet-cfml ICYMI - Adobe ColdFusion 2021 and 2018 October Security UpdatesCommandBox images are out as wellWe are pleased to announce that we have released the updates for the following ColdFusion versions: ColdFusion (2021 release) Update 5 ColdFusion (2018 release) Update 15 In these updates, we've fixed a few security and feature-specific bugs, along with other libraries. We've also introduced support for M1 macOS.For more information, see the tech notes below: ColdFusion (2021 release) Update 5 ColdFusion (2018 release) Update 15 https://community.adobe.com/t5/coldfusion-discussions/released-coldfusion-2021-and-2018-october-security-updates/m-p/13259746 ICYMI - cbElasticsearch 2.3.3 ReleasedWe are pleased to announce the release of cbElasticsearch version 2.3.3. cbElasticsearch is the Elasticsearch module for the Coldbox platform, and provides a fluent CFML API for interacting with, searching, and serializing to Elasticsearch servers.This release adds full compatibility for Elasticsearch v8.x as well as maintaining support for Elasticsearch versions 6 and 7.https://www.ortussolutions.com/blog/cbelasticsearch-233-released ICYMI - Fusion Reactor 9.1.0 Not long after FR 9 was released, 9.1.0 has been released with 2 bug fixes and 5 improvements.https://docs.fusion-reactor.com/release-notes/#910 Webinar / Meetups and WorkshopsNew Ortus Friday Webinars - Every Friday at 11am CDTOrtus Webinar October 28th - 11am CDTStep up your Testing with Gavin Pickin Ortus - Office HoursNovember 4th - 11am CDTDaniel Garcia will host a variety of Ortus people Office Hours questions & requests form availableOrtus Book Club - Patreon OnlyNovember 11th - 11am CDTRobert Martin Clean CodeOrtus WebinarNovember 18th - 11am CDT CFUG Tech Talk - Document Services APIs and You by Raymond CamdenThursday, October 20th, 2022 8:00pm-9:00pm IST (9:30 AM CDT)Most organizations have to deal with documents, from PDFs to various Office formats, managing and processing documents can be overwhelming. In this talk, Raymond will discuss the various Adobe Document Services APIs and how they can help developers manage their document stores.Register: https://www.eventbrite.com/e/document-services-apis-and-you-tickets-428587234957 Presentation URL: https://meet67421977.adobeconnect.com/document-services-apis/ CFHawaii - ColdFusion Builder for VS CodeFriday, October 28, 2022 at 3:00 PM to Friday, October 28, 2022 at 4:00 PM PDTMark Takata, the Adobe CF Technical Evangelist for ColdFusion will give a presentation on the new ColdFusion Builder extension for VS Code. During his talk he will discuss:Access built-in support for IntelliSense code completion, better semantic code understanding, and code refactoring.Identify security vulnerabilities and maintain the integrity of your code.Manage your work with extensions, remote project support, integrated server management, a log viewer, and more!Customize every feature to your liking by creating shortcuts, easily formatting and reusing code, and using powerful extensions to better your best.https://www.meetup.com/hawaii-coldfusion-meetup-group/events/288977258/ Adobe Workshops & WebinarsJoin the Adobe ColdFusion Workshop to learn how you and your agency can leverage ColdFusion to create amazing web content. This one-day training will cover all facets of Adobe ColdFusion that developers need to build applications that can run across multiple cloud providers or on-premiseWEBINAR - WEDNESDAY, NOVEMBER 23, 202210:00 AM PSTBuilding Native Mobile Applications with Adobe ColdFusion & Monaco.ioMark Takatahttps://building-native-mobile-apps-with-cf-monaco-io.meetus.adobeevents.com/ WEBINAR - THURSDAY, DECEMBER 22, 202210:00 AM PSTWinter Holiday Special: A preview of ColdFusion 2023Mark Takatahttps://winter-special-preview-of-cf2023.meetus.adobeevents.com/ FREE :)Full list - https://meetus.adobeevents.com/coldfusion/ CFCasts Content Updateshttps://www.cfcasts.comJust Released Every video from ITB - For ITB Ticket Holders Only - Will be released for Subscribed in December 2022 ForgeBox Module of the Week Series - 1 new Video https://cfcasts.com/series/2022-forgebox-modules-of-the-week 2022 VS Code Hint tip and Trick of the Week Series - 1 new Video https://cfcasts.com/series/2022-vs-code-hint-tip-and-trick-of-the-week  Coming Soon - Now that ITB is over we can get back to our Video Series More ForgeBox and VS Code Podcast snippet videos Box-ifying a 3rd Party Library from Gavin ColdBox Elixir from Eric Getting Started with ContentBox from Daniel ITB Videos will be released Dec for those who are not ITB Ticket Holders Conferences and TrainingICYMI - ViteConfTuesday and Wednesday October 11-12, 2022Online: FreeMaking Web Development Instanthttps://viteconf.org/ICYMI - Microsoft IgniteWednesday-Friday October 12–14, 2022Online: FreeIn Person: $1895Explore the latest innovations, learn from product experts and partners, level up your skillset, and create connections from around the world. Join us October 12–14 at 9:00 AM PDT to help shape the future of tech.https://ignite.microsoft.com/en-US/home AWSome Day Online Conference - This weekTHURSDAY, OCTOBER 20, 20229AM – 12PM PT | 12PM – 3PM ETWe're bringing the cloud down to EarthJoin us for a free virtual 3-hour AWS Cloud training event delivered by our skilled in-house instructors.https://aws.amazon.com/events/awsome-day/americas/ Deploy from Digital OceanNovember 15-16, 2022The virtual conference for global buildersSubtract Complexity,Add Developer HappinessJoin us on the mission to simplify the developer experience.https://deploy.digitalocean.com/ Into the Box Latam 2022Dec 7thMore information is coming very soon.Dev NexusApril 4-6th in AltantaEARLY BIRD CONFERENCE PASS - APRIL 5-6 (AVAILABLE UNTIL NOVEMBER 20) (Approx 40% off)If you are planning to speak, please submit often and early. The CALL FOR PAPERS is open until November 15WORKSHOPS WILL BE ON JAVA, JAVA SECURITY, SOFTWARE DESIGN, AGILE, DEVOPS, KUBERNETES, MICROSERVICES, SPRING ETC. SIGN UP NOW, AND YOU WILL BE ABLE TO CHOOSE A WORKSHOP, LATER ON,https://devnexus.com/ Into the Box 2023 - 10th EditionMay 17, 18, and 19th, 2022.Middle of May - start planning.Final dates will be released as soon as the hotel confirms availability.CFCampNo CFCAMP 2022, we're trying again for summer 2023TLDR is that it's just too hard and there's too much uncertainty right now.More conferencesNeed more conferences, this site has a huge list of conferences for almost any language/community.https://confs.tech/Blogs, Tweets, and Videos of the Week10/17/22 - Blog - Charlie Arehart - ColdFusion 2021 "refreshed" installers available (with update 5)...but only in one place for nowHere's some surprising news: Adobe has released a "refreshed" installer for CF2021, which includes update 5 (which came out last week) built-in.Did you know about this? You'd be forgiven if you had not heard, for reasons I will explain. And I'm glad to share the news, though it's a good news/bad news sort of thing (just like with the update itself. More on that in another post to come.)TLDR: these new "refreshed" CF2021 installers are (for now) available only here: here.https://www.carehart.org/blog/2022/10/17/cf2021_refreshed_installers_available_but_only_one_place_for_now 10/17/22 - Tweet - James Moberg - Boolean Coercion in JavascriptI learned #coldfusion long before javascript, I often forget that CFML is non-standard & treats numeric values as boolean. This obviously doesn't work in JS. Using Boolean() or !! is recommended for coercion.Here's some helpful tips that I found:https://www.samanthaming.com/tidbits/19-2-ways-to-convert-to-boolean/https://twitter.com/gamesover/status/1582166204910686209https://twitter.com/gamesover10/14/22 - Blog - Julian Halliwell - Adding validation drop-downs to your spreadsheets with CFMLAs web application developers we're used to adding drop-downs to our web UIs via HTML elements. They're a reliable way of making sure people make a valid choice from a limited set of options - countries or credit card providers, for instance.Drop-down lists are also supported in the world of spreadsheets via "Data Validation" or"Validity" menu options, depending on the software you are using.https://blog.simplicityweb.co.uk/131/adding-validation-drop-downs-to-your-spreadsheets-with-cfml 10/13/22 - Blog - Ben Nadel - Trying To Get The Most Trustworthy IP Address For A User In ColdFusionOn a recent Penetration Test (PenTest), one of our systems was flagged for not properly validating the X-Forwarded-For HTTP header, which is a recording of the various IP addresses along the network path being made by an inbound request. To be honest, I've never really thought deeply about IP addresses from a security standpoint before; but, having this show up on a PenTest sent me down a bit of a rabbit hole. And, I thought it might be worth talking a bit about why IP addresses pertain to security in ColdFusion.https://www.bennadel.com/blog/4337-trying-to-get-the-most-trustworthy-ip-address-for-a-user-in-coldfusion.htm 10/13/22 - Tweet - Brian Rielly - Coldfusion Xml Allow Path - CF 2021 Update 5 breaks XMLhmmm...I haven't tested this at all yet, but I wonder if orgs that need to set  "coldfusion.xml.allowPathCharacters = true" will loose any added protection against XXE, XSLT injection, and other XML-based attacks.#coldfusion #xxe #xml #APSB22-44https://stackoverflow.com/questions/74058674/coldfusion-2021-update-5-breaks-xmlhttps://twitter.com/hoyahaxa/status/1580618984231096321https://twitter.com/hoyahaxa 10/12/22 - Tweet - Adam Cameron - Writing code on ColdFusion 5… https://twitter.com/adam_cameron/status/1580103376041230336 https://twitter.com/adam_cameron 10/11/22 - Blog - Mark Takata - Adobe - CFSummit 2022 RecapWell, that's another CF Summit in the books, and the first in-person event in 2 years. It was an absolute joy and thrill to be able to see all of you that made it to the event this year in person. I just wanted to take a moment and re-live a bit of the fun, give thanks to folks and give some updates.https://coldfusion.adobe.com/2022/10/cfsummit-2022-recap/ 10/11/22 - Blog - Mark Bockenstedt - Can Destructured Variables Be Scoped In ColdFusion?Destructuring is a convenient way to assign the values from complex objects like arrays & structs into distinct variables. That's all well & good, but all examples I've seen don't bother with variable scoping. Proper scoping is important for explicitness and to better understand where your variables are coming from. Without proper scoping, you may be pulling a variable from an unexpected location.All examples that follow were written and executed on ColdFusion 2021, Update 4 using cffiddle.org.https://www.bockensm.com/2022/10/11/scoping-destructured-variables/ 10/7/22 - Tweet Thread - Brad Wood - explaining wireboxWith a framework like WireBox, the calling code doesn't need to know* where the dependency lives* how to build it* what init() args it requires* what nested dependencies it needsYou just call wirebox.getInstance( "foobar" ) and WireBox does the rest. #abstractionLike when you order a steak at Applebee's- you don't tell the chief where the cow lives, what the cow needs to eat, or where his seasonings are in the kitchen.  You just ask the waiter for a "steak" and the kitchen does the rest.https://twitter.com/bdw429s/status/1578464811553554438 https://twitter.com/bdw429s CFML JobsSeveral positions available on https://www.getcfmljobs.com/Listing over 142 ColdFusion positions from 78 companies across 65 locations in 5 Countries.4 new jobs listed this weekFull-Time - ColdFusion Developer at India - India Oct 18https://www.getcfmljobs.com/jobs/index.cfm/india/ColdFusion-Developer-at-India/11529Full-Time - Senior ColdFusion Developer at Brisbane QLD - Australia Oct 17https://www.getcfmljobs.com/jobs/index.cfm/australia/Senior-ColdFusion-Developer-at-Brisbane-QLD/11528Full-Time - SE-ColdFusion at Bengaluru, Karnataka - India Oct 13https://www.getcfmljobs.com/jobs/index.cfm/india/SEColdFusion-at-Bengaluru-Karnataka/11526Full-Time - Senior Software Engineer-ColdFusion Developer at United Stat.. - United States Oct 13https://www.getcfmljobs.com/jobs/index.cfm/united-states/Senior-Software-EngineerColdFusion-Developer-at-United-States/11527Other Job Links Ortus Solutions https://www.ortussolutions.com/about-us/careers  There is a jobs channel in the CFML slack team, and in the box team slack now too ForgeBox Module of the WeekPKCE - pronounced PIXIEBy Matt GiffordPKCE GeneratorA CFML component to generate or verify a Proof Key for Code Exchange (PKCE) challenge pair.https://www.forgebox.io/view/pkceVS Code Hint Tips and Tricks of the WeekJavaScript (ES6) code snippetsThis extension contains code snippets for JavaScript in ES6 syntax for Vs Code editor (supports both JavaScript and TypeScript).https://marketplace.visualstudio.com/items?itemName=xabikos.JavaScriptSnippets Thank you to all of our Patreon SupportersThese individuals are personally supporting our open source initiatives to ensure the great toolings like CommandBox, ForgeBox, ColdBox,  ContentBox, TestBox and all the other boxes keep getting the continuous development they need, and funds the cloud infrastructure at our community relies on like ForgeBox for our Package Management with CommandBox. You can support us on Patreon here https://www.patreon.com/ortussolutionsDon't forget, we have Annual Memberships, pay for the year and save 10% - great for businesses. Bronze Packages and up, now get a ForgeBox Pro and CFCasts subscriptions as a perk for their Patreon Subscription. All Patreon supporters have a Profile badge on the Community Website All Patreon supporters have their own Private Forum access on the Community Website All Patreon supporters have their own Private Channel access BoxTeam Slack Live Stream Access to streams like “Koding with the Kiwi + Friends” and Ortus Book Club https://community.ortussolutions.com/ Patreons John Wilson - Synaptrix Jordan Clark Gary Knight Mario Rodrigues Giancarlo Gomez David Belanger   Dan Card Jonathan Perret Jeffry McGee - Sunstar Media Dean Maunder Nolan Erck  Abdul Raheen Wil De Bruin Joseph Lamoree   Don Bellamy Jan Jannek   Laksma Tirtohadi   Brian Ghidinelli - Hagerty MotorsportReg Carl Von Stetten Jeremy Adams Didier Lesnicki Matthew Clemente Daniel Garcia Scott Steinbeck - Agri Tracking Systems Ben Nadel  Richard Herbet Brett DeLine Kai Koenig Charlie Arehart Jason Daiger Shawn Oden Matthew Darby Ross Phillips Edgardo Cabezas Patrick Flynn Stephany Monge   Kevin Wright John Whish Peter Amiri Cavan Vannice John Nessim You can see an up to date list of all sponsors on Ortus Solutions' Websitehttps://ortussolutions.com/about-us/sponsors Thanks everyone!!! ★ Support this podcast on Patreon ★

An airhacks.fm conversation with Dmitry Chuyko (@dchuyko) about: Logo on BK, and Basic on Nemiga, Pentium 1, AltaVista and Lycos, starting with Pascal, C, then Borland's Kylix, controlling the CD tray, managing toy production with MS Access, writing drivers for Windows at high school, math over programming, joining Borland, Visual Basic, C++, XSLT then Java, from C++ to Java, using Apache Xalan, using Apache FOP for transformations, fancy XML in 2003, Java on desktop, using Java on cellular phones, simplifying Java EE with visual modelling, working in a 4G startup, using JXTA for car to car communication, starting at QuickOffice, writing backend for Deutsche Bank, starting at Oracle performance team, if you want to go to Oracle, you go to Delphi, improving Java performance, joining BellSoft, Liberica JDK, BellSoft is top openJDK and JCP contributor, Liberica's native image Kit, Dmitry Chuyko on twitter: @dchuyko

В этом выпуске: чему научились за неделю; обзор очередного видео: Index Concurrency Control; тонкости pg_stat_activity; подробный разбор пейпера про Amazon DynamoDB; темы и вопросы слушателей. Шоуноты: [00:02:42] Чему мы научились за неделю GitHub — petere/plxslt: XSLT procedural language for PostgreSQL https://twitter.com/JI/status/1546948817462800384 PostgreSQL: How to inherit search_path from template https://twitter.com/marcan42/status/1549672494210113536 [00:15:25] 08 — Index Concurrency Control… Читать далее →

Michael Kay is the editor of the W3C XSLT 2.0 and 3.0 language specifications for performing XML transformations and the developer of the Saxon XSLT and XQuery processing software. The video is here: https://youtu.be/2Zt9oJtFKGw

SAP Community Blog Review for 2021 April Best Picks 1 - Integration Advisor XSLT functions Integration Advisor – List of supported XSLT elements and XPath functions https://blogs.sap.com/2021/04/06/integration-advisor-list-of-support-xslt-elements-and-xpath-functions/ Integration Advisor – Mapping element functions, the use of xsl:copy, xsl:copy-of, xsl:sequence, or xsl:value-of https://blogs.sap.com/2021/04/06/integration-advisor-mapping-element-functions-the-use-of-xslcopy-xslcopy-of-xslsequence-or-xslvalue-of/ Integration Advisor – Mapping element functions for comparing nodes and values https://blogs.sap.com/2021/04/08/integration-advisor-mapping-element-functions-for-comparing-nodes-and-values/ 2 - Value Mapping migration from SAP PO to CPI How to import SAP PO value mappings into SAP CPI (Cloud Integration) https://blogs.sap.com/2021/04/13/how-to-import-sap-po-value-mappings-into-sap-cpi-cloud-integration/ 3 - An example with good storytelling and clear explanation SAP Integration Suite – Scrape and visualize data as you please https://blogs.sap.com/2021/04/23/sap-btp-integration-suite-scrape-and-visualize-data-as-you-please/ 4 - Which component name to use while opening tickets for standard packages Identifying the Correct Standard Cloud Integration Package Support Component https://blogs.sap.com/2021/04/30/identifying-the-correct-standard-sci-integration-package-support-component/ 5 - Custom Mapping Functions in CPI Understanding Groovy Scripting for SAP Integration Suite – Part 1 https://blogs.sap.com/2021/04/08/understanding-groovy-scripting-for-sap-integration-suite-part-1/ Understanding Groovy Scripting for SAP Integration Suite – Part 2 https://blogs.sap.com/2021/04/08/understanding-groovy-scripting-for-sap-integration-suite-part-2/ UDFNodePool Functions for SAP CPI with Groovy Scripting https://blogs.sap.com/2021/04/25/udfnodepool-functions-for-sap-cpi-with-groovy-scripting/ 6 - SAP API Management – Error handling options SAP API Management – Error handling with FaultRules, the DefaultFaultRule and the RaiseFault Policy (Part 1 of 2) https://blogs.sap.com/2021/04/21/sap-api-management-error-handling-with-faultrules-the-defaultfaultrule-and-the-raisefault-policy-part-1-of-2/ SAP API Management – Error handling with FaultRules, the DefaultFaultRule and the RaiseFault Policy (Part 2 of 2) https://blogs.sap.com/2021/04/28/sap-api-management-error-handling-with-faultrules-the-defaultfaultrule-and-the-raisefault-policy-part-2-of-2/ New Features Malware scanner in SAP Cloud Integration https://blogs.sap.com/2021/04/06/malware-scanner-in-sap-cloud-integration/ How-to Articles SAP Cloud Integration with Workflow and Business Rule https://blogs.sap.com/2021/04/13/cloud-integration-with-workflow-and-business-rule-in-sap-btp-cloud-foundry/ CPQCPI1-SAP CPI – Calling CPQ REST API in CPI and fetch the data from CPQ. https://blogs.sap.com/2021/04/05/sap-cpi-calling-cpq-rest-api-in-cpi-and-fetch-the-data-from-cpq./ CPQCPI2-SAP CPQ REST API Authentication via JWT token in CPI https://blogs.sap.com/2021/04/05/sap-cpq-rest-api-authentication-via-jwt-token-in-cpi/ Fixed Length File Generation Scenario Through SAP Cloud Platform Integration https://blogs.sap.com/2021/04/08/fixed-length-file-generation-scenario-through-sap-cloud-platform-integration/ How To Setup a Test SFTP connection for Testing your CPI Iflows end to end https://blogs.sap.com/2021/04/09/how-to-setup-a-test-sftp-connection-for-testing-your-cpi-iflows-end-to-end/ Configure SFTP on your local machine and connect to CPI https://blogs.sap.com/2021/04/21/configure-sftp-on-your-local-machine-and-connect-to-cpi/ SCPI Sender – Certificate-to-User Mapping with SAP Passport https://blogs.sap.com/2021/04/13/scpi-sender-certificate-to-user-mapping-with-sap-passport/ Setup of Api management/Cloud Foundry services with sap cloud connector on Kubernetes/Gardener https://blogs.sap.com/2021/04/13/setup-of-api-management-cloud-foundry-services-with-cloud-connector-on-kubernetes-gardener/ Use SAP BTP Integration Suite to Integrate S4/HANA Cloud with Third-Party System https://blogs.sap.com/2021/04/19/use-sap-btp-integration-suite-to-integrate-s4hana-cloud-with-third-party-system/ How to configure a simple synchronous SOAP consumer in R3 system with CPI SOAP Adapter https://blogs.sap.com/2021/04/10/how-to-configure-a-simple-synchronous-soap-consumer-in-r3-system-with-cpi-soap-adapter/ SharePoint Integration using SAP CPI (Without SAP Open Connector) https://blogs.sap.com/2021/04/15/sharepoint-integration-using-sap-cpi-without-sap-open-connector/ Community Tooling Updates How to create vector graphics from IFlows https://blogs.sap.com/2021/04/09/how-to-create-vector-graphics-from-iflows/ From CPI IFlow to diagram with iflow-plotter https://blogs.sap.com/2021/04/23/from-cpi-iflow-to-diagram-with-iflow-plotter/ High-Resolution Flow Images for Documentation https://blogs.sap.com/2021/04/25/high-resolution-flow-images-for-documentation/ Bulk MPL Attachment Download with CPI Explorer for SAP Cloud Integration https://blogs.sap.com/2021/04/13/bulk-mpl-attachment-download-with-cpi-explorer-for-sap-cloud-integration/ Blog Series SAP CPI setup in a multi-stage system landscape using Figaf DevOps https://blogs.sap.com/2021/04/20/blog-series-sap-cpi-setup-in-a-multi-stage-system-landscape-using-figaf-devops/ Extra Cloud Integration, SAP HCI, SAP CPI Interview Questions. https://blogs.sap.com/2021/04/06/cloud-integration-sap-hci-sap-cpi-interview-questions./

Even with all of the WordPress consolidation happening, there's still plenty of opportunity ahead for the industry. There's lots of potential users, customers, and room for investment (note: we just saw the acquisition of Yoast happen by Newfold, formally EIG. If I had to guess, somewhere between a $30-50M deal.) If you though the plugin space is crowded or even more specifically the membership & LMS veritcal, then I have a surprise for you today. Nathalie Lussier, founder of AccessAlly a LMS plugin for WordPress joins us to talk about her venture in building her business. From selling online courses and building community to building and selling software — this is a fantastic lesson for all of us. Her and her team are really proving that in the a crowded market, you stand apart from the crowd by knowing who your perfect customer is and building them the perfect product. Episode Transcript [00:00:00] This episode is brought to you by paid memberships pro well, actually it's their other product. Site-wide sales at site-wide sales.com. It's a complete black Friday cyber Monday and flash sales tool for WooCommerce or paid memberships pro. Before, you know it, the deal day holidays will be fast upon us. And you want to prepare your WooCommerce or paid memberships pro website.[00:00:20] With the site-wide sales plugin, use it to make custom sale banners, targeted landing pages or apply discounts automatically in the cart. Use it to track the performance of all of these promotional features using the reporting feature, which will paint the picture of your black Friday and holiday shopping sales. I use it to help make your woo commerce or paid memberships pro store more money.[00:00:43] Get the first 30 days for free. And then it's an easy $49 a year. Check out site-wide sales.com. That's site-wide sales.com to make more money. This holiday sale season.[00:00:56] Matt: Even with all of the WordPress consolidation happening, there's still plenty of opportunity ahead for them. There's lots of potential users, customers, and room for investments notes. We just saw the acquisition of Yoast happened by new fold, formerly EIG. If I had to guess a deal somewhere between a 30 and $50 million acquisition, if you thought the plugin space is crowded or even more specifically, the membership and LMS vertical is crowded.[00:01:22] Then I have a surprise for you today, Natalie Lucier founder of access, ally and LMS plugin for WordPress joins us to talk about her venture in building her. From selling online courses and building community to building and selling software. This is a fantastic lesson for all of us. Her and her team are really proving that in the crowded space, you stand apart from the crowd by knowing who your perfect customer is and building them the perfect product you're listening to the Maryport a podcast for the resilient digital business builders.[00:01:51] Subscribe to the newsletter maryport.com/subscribe and follow the podcast on. Spotify, wherever you listen to your favorite podcasts better yet. Please share this episode, please do, because I just read that the best way to grow a podcast is word of mouth and sharing. So please share this episode with others.[00:02:09] We'd love more listeners around here. Okay. Let's get into today's episode.[00:02:13] It almost feels like a SAS software as a service. Tell us about that, that moment when you realize I'm teaching people, I might as well build the software too.[00:02:22] Nathalie: Yeah, absolutely. So I was in the like marketing and tech space and doing videos on like, how to build a popup and how to do things on your WordPress site and how to market your courses and all of that stuff. And I was teaching. In courses and also on YouTube and people who were, signing up to our free challenge.[00:02:42] We had a challenge called the 30 day list building challenge to help people build an email list and they were signing up. And it was, becoming pretty popular. So we had a lot of people logging in at the same time. And at the time. I thought we were getting attacked by hackers or something.[00:02:56] Cause we have so many logins and the way that our plugin that we were using at the time it kept pinging our CRM and every single time somebody went to any page on that site. So, we were having nightmares basically. I would wake up every morning and have to call my host to have them. Unlock us, essentially, we put my website back up and then all the people who were signing up were upset with us because, they signed up and they couldn't get what they were asking for or what we had promised.[00:03:21] So essentially my husband and I were like, okay, let's just quickly whip up a plugin to replace what we have right now, just to stop this problem. And so that's literally in one weekend we wrote the first beta beta version of access ally. And it was just to solve our own problem. Yeah. But then after that, we kind of realized like, Hey, okay, this gives us a lot of, interesting options.[00:03:40] And we started adding on and kind of building other things that we thought would be very useful for the people going through our courses and content. And that was kind of the start of what you see today.[00:03:51] Matt: So you ha I, I didn't write this down in our peer review, but what was the timeline you had popup ally first and then.[00:03:58] Then we created access ally, correct?[00:04:00] Nathalie: Yes. So we built SSLI first just to solve this problem. And we knew that someday we might release something like this, but it just felt like too big of an undertaking to do a whole like online membership or LMS or anything like that. So we ended up building popup ally next and releasing that first because we knew we could do a free version.[00:04:19] We could see how that went. Then we could do a paid version and see how that was. Being responded to and how we could handle support and all of that. And then we realized, okay, yes, we can actually do this. We have the chops. And so let's go all in on SSLI and kind of build[00:04:33] Matt: that. And I'll, I'll paint sort of the the, the picture at least of the way that I see it in my head is pop-up plugin a very, very broad market, big market.[00:04:44] Chances are anyone who might be selling courses or digital content is going to be attracted to a pop-up to use on their site to capture the visitor's attention. And, oh, by the way, we also. Have this LMS plug-in fair statement.[00:04:58] Nathalie: Yeah, it totally started off that way. It's a much broader, pop-ups are much broader.[00:05:02] And then, yeah, like you said, people who are using them to build an email list and audience, they probably will want to sell something online. So, so that pretty much leads to access ally.[00:05:12] Matt: Yeah. I want to start with something that I won't say it's a curve ball, but a little bit on the hot seat, but something that I totally enjoy what you're doing with access ally is the pricing.[00:05:22] And I think I know a lot of Plugins in the space a lot of, well, let me ask you this question. Before I dive into that, do you refer to it as a plugin or software? Like how do you feel about the product itself? I don't want to just say plug in if you feel like you're greater than that.[00:05:40] This episode is brought to you by paid memberships pro well, actually it's their other product. Site-wide sales at site-wide sales.com. It's a complete black Friday cyber Monday and flash sales tool for WooCommerce or paid memberships pro. Before, you know it, the deal day holidays will be fast upon us. And you want to prepare your WooCommerce or paid memberships pro website.[00:06:01] With the site-wide sales plugin, use it to make custom sale banners, targeted landing pages or apply discounts automatically in the cart. Use it to track the performance of all of these promotional features using the reporting feature, which will paint the picture of your black Friday and holiday shopping sales. I use it to help make your woo commerce or paid memberships pro store more money.[00:06:24] Get the first 30 days for free. And then it's an easy $49 a year. Check out site-wide sales.com. That's site-wide sales.com to make more money. This holiday sale season.[00:06:37] Nathalie: Yeah. So it is technically a plugin, right?[00:06:39] So people download it and install it. But we do see it as software, as a service, just because we are constantly developing and people have so many feature requests and things that we're constantly updating. So, and then we also offer a lot of support. So that's the service side as well. So I do feel like it's a little bit more than just like here, download this plugin and good luck.[00:06:57] It is like a real partnership. And I think that's why the price, in my opinion reflects that when people will come to the website and people also do think so. I mistake that it's a platform and that it's totally hosted. And we've talked about potentially doing that, but we do also appreciate that it's a plugin and they could work with other things.[00:07:13] And there's a lot of benefits to being in that WordPress ecosystem too.[00:07:18] Matt: That's sometimes it's a disadvantage for a bulk of visitors that come to the site and they go, oh, wait, I was looking for a plugin. This looks like a platform. Do you, have you ever noticed that a drop off in the quote unquote funnel at all, that, that you've actually paid close attention[00:07:33] Nathalie: to?[00:07:33] Usually it goes the other way where they wanted a platform and then they're like, oh wait, I need to WordPress. So most, most of our marketing so far is kind of the opposite, but yeah.[00:07:44] Matt: Yeah, I wanted to give you a sort of a fair chance to see how you disseminated between the plugin and the, and the soft.[00:07:51] As a mindset, because I think a lot of us, myself included, like I have a tiny little plugin, easy support videos. I've done other plugins in the past, which have burned a miserable failure of a death. And, but the fact of the matter is I was always kind of just like, oh yeah, it's just, it's just this plugin.[00:08:08] And I think a lot of us just have to say, no, This is a software business. Like let's, let's, let's, let's give ourselves a little bit of credit here. Like this is a software business that we're in. We're not just like this little throw away plugin, even though that's the technical term for it. And I think we could do a lot for ourselves mentally.[00:08:24] If we just have a little bit more of that, that confidence boost when, and when we look at it, because it changes the mindset, it changes how you approach it. And that's what I want to talk about with your. $99 a month. That's what access ally essentials starts with. That's one website. Very far beyond what, you might see from just, let's say a free LMS or an LMS plug-in that's $79 for the year or something like that.[00:08:49] How did you get to this pricing? Was it immediate or did you have some bumps and bruises along? That's[00:08:55] Nathalie: a great question. So we started off at 79 a month. That was before, that was the first price that we started originally a couple of years ago. But yeah, we've, we've had a lot of conversations internally and a lot of it really comes down to what value I think we really provide to people.[00:09:10] So we are pretty close to making people money, right. So we help them take payments. We have an affiliate program built in and we basically help them sell courses. All kinds of other things. So that to me shows me that we can provide a lot of value for them. And when you're comparing, what other tools they might be purchasing to do with something similar, sometimes they might be purchasing, multiple things like maybe it's multiple plugins, or maybe it's like one thing for a shopping cart, one thing for this other thing.[00:09:36] And then by the time you add up all the time, Invested in making all of those things work together. That's kind of to us a lot of value, so that's kind of how we thought about it. And then we were also just looking around at some of the competition and also what we knew we needed to charge to provide the service that we wanted.[00:09:52] So that also came into it a lot. So we have two full-time support people and US-based, they we love taking care of our teams, so they have, good salaries and benefits. And I don't think we could do that if we were trying to charge less and try to compete on the, on the pricing side, we wanted to really provide more value and then also charge well for it.[00:10:12] And there is also something that changes when somebody pays more for software, which is that they're a little bit more committed. They're really in it for the longterm. Most likely to stick as well. So like, obviously if it's too expensive for them, they're not going to sign up in the first place. So we kind of lose people that way, but we do have more people signing up and staying long-term because they know we're kind of in that partnership.[00:10:33] And a lot of times people tell us we love access ally because it lets us do all these great things. But also because every time we have a question or we have something we want to do that just quite do yet, it comes out like a month or two later. Right. So that's something we couldn't do if we were, trying to appeal to too many people at a lower price.[00:10:51] Matt: You have a degree in software engineering, this, that answer and the way you've positioned the product is what I'll say. And these are my words, not yours is a much more mature business answer than what I normally see in the WordPress space. Again, myself included, you build a product you're like, oh my God, does anybody want to buy this?[00:11:11] And then you say to yourself, I know what I'll do. I'll just make it cheap. Then somebody will certainly buy it. But you, you jumped in at an eight. 860 ish dollar a year or a little bit more at my mass. Not really good right out of the gate at 79 bucks a month. Is this the first business you've launched or this you're a second, third, fourth, fifth business.[00:11:29] Cause it sounds like you've gone through the paces a little bit before.[00:11:32] Nathalie: Absolutely. So yeah, this is not the first business. And I started off with my very first business out of college. It was all in the healthy eating space and that was kind of my training business. So I just learned like marketing and like I built my own website and all of those things.[00:11:45] And then. The kind of teaching of the online stuff and the online marketing was kind of the next one. And then this is sort of the third business I would call it and yeah, it, it definitely like we learn so much. Yeah. Yeah.[00:11:58] Matt: And this is a great thing because I think this is hard to just like, this is not a question, but much more of just like a general statement and then interested on your thoughts, but it sort of raises the value of all of us, right?[00:12:12] When you price your product like this. Well, you're getting true value. You're asking for true value. And on the other end, it's a, it's a solid business. Like you said, there are people working for us. We're paying them well, you're going to get great support. You're probably getting a higher degree of customer as well.[00:12:30] Like they're not coming in, just like, give me all this free stuff. Cause they're already paying a hundred bucks a month. So there's a different level there. There's money out there that I think a lot of people just get a fee. I get that fear factor where like, oh, I guess I do have to do a hundred bucks for the year because my God, nobody will buy it otherwise.[00:12:46] But yes, there are people who just want good stuff with great support. And that's the most important part for them is to like have somebody that's going to be there for them and stand the test of time. Right. Especially if they're a long-term WordPress user who has seen other places come and go or freelancers come and go, they don't want that.[00:13:08] Their vote of confidence is I will pay you a solid amount of money. So you stay in business and support me. Well, But it sounds like you've learned that over the years and that's how you've got to this point.[00:13:18] Nathalie: I literally had customers tell us that we know you're not going to disappear overnight because we're paying you well, and that's worth it to me.[00:13:24] Is that kind of security. And yeah, absolutely. We have that long-term vision and that long. Yeah. Stay in the game kind of energy. And I think that definitely comes across with the people that end up signing up for us. Yeah.[00:13:37] Matt: To that. I was going to put you on the hotspot, but then we kinda, we kind of shifted a little bit on your pricing page.[00:13:42] One of the check marks is top of the line support. I feel like everyone might say top of the line support, or we have the best support. What does top of the line of support mean for you and for your customers?[00:13:53] Nathalie: Yeah, we have a lot of things that we do for our customers. So everyone gets a free jumpstart calls.[00:13:58] So that means after they purchase, we get on like a zoom call with them. We help them get everything set up. We answer any questions they have. We make sure it works with the things that they're currently using or planning to use. So that's a big part of it. And then we also have a tune-up calls. Three times a month right now.[00:14:14] And so they can jump on any time they have questions or want to walk through something that they're trying to accomplish, that maybe they got stuck on. And then in terms of actually, if you get into a situation where you're stuck or anything like that in between, then we also have email support. And like I said, we have two people dedicated to that.[00:14:30] And obviously our response time varies, but right now it's like averaging at eight minutes, which is kind of crazy. So during this. So, yeah, we do have, we do a lot and then we also have really robust, message-based and videos and all of that stuff to make sure if you're more of a, self-serve kind of like, I just, I'm working at midnight.[00:14:47] I know you're not gonna be online. I'm just going to finish this up and watch this video kind of thing.[00:14:51] Matt: Yeah, it's fantastic. It's one of the things I do as part of my role at cast dose is we do two weekly calls, Tuesdays and Thursdays, 12:00 PM, Eastern, same kind of thing, open office hours, or show up.[00:15:02] If you have a question, you can answer it there. We don't do phone support, which is still like a thing these days. Like people still are like, why can't I just call somebody? It's like, well, we have these two dedicated hours where you can hop on a zoom call and you can chat with us, which I think is a fairly fair approach.[00:15:16] Plus. Nearly 24 7 help desk support through Zendesk and an email and chat. So, that's a fantastic approach. I certainly like your approach of having that onboarding call that kickoff, call that alone, which I know developers, the more developer mindset folks who don't want to talk to anybody. I just want to print money with my product that I'm selling.[00:15:36] Don't ever talk to me, just buy it. Man, you can re like that's literally what you can charge. Out of the gate. Like if you just tell somebody that you buy this and I'll hop on a zoom call to help you set it up, whatever that means for your product, that's worth so much money to somebody. And it's just that one hour of your time.[00:15:53] I know there could be some chances where they knock on the door against, Hey, we're going to hop on another call. I think largely 95% of your customer base will never knock on your door again and just email you. And I think that's a fantastic approach. I applaud you for that. What else do you provide on those tune-up calls?[00:16:10] Is there anything else that you do in a more structured approach? I just leave the door open. I say, come in and show up and ask anything you want, but do you approach it with any more structure than that? Yeah,[00:16:19] Nathalie: for the most part, we just talk about what people bring to the, to the call, but sometimes we do have like new features or new scenarios and things that we've kind of seen people creating and we want to share it with them.[00:16:30] So sometimes we'll do like, okay, you're doing a teams kind of feature. So that basically means, you're selling to a bulk group of people and then here's how you set that up. And here's how they would assign other team members to the courses and that kind of stuff, or we'll do like, okay, here's what you need to know about doing this summit.[00:16:46] If you're using XSLT to run your summit, like how you do that. So we'll kind of talk about a little bit about those scenarios that are kind of either popular or that we've seen someone do really well and kind of want to share with the rest of the community.[00:16:57] Matt: Gotcha. No, that's awesome. I will, I will write that down or release it to my episode and then apply that to cast those next time.[00:17:04] I'm on my next time. I'm on my call. You started to, to say that, look, we know who our customer is. One they're paying a little bit more. We're helping them make money. Who would you say your best customer profile is for accessing.[00:17:19] Nathalie: So some of our best customers are people who are in the business space.[00:17:23] So they may not be like teaching business, but maybe they have business processes that help other business owners. So kind of that team aspect I was talking about. So, we have people who are, let's say a sales trainer, and then they've got a program that they've developed that they sell to other companies to train their sales teams.[00:17:38] Or we have someone who's doing a coaching certification. So she's a coach and she's teaching other people how to become a coach. So they will become certified in her method. So there's a lot of that kind of teaching something, but two groups of people that tends to be one of our bigger people. So we have like a dog trainer and I think, she comes in and she's, she's got groups of doc trainers in other businesses learning her methods and that kind of thing.[00:18:01] So that seems to be one of our, our ideal.[00:18:04] Matt: Yeah, no, that's awesome. That's awesome that you can identify. How can you paint the picture of how that has changed if at all, from when you first started the business? Like, did you go into the business thinking, yeah, we're going to serve this one particular set it's changed.[00:18:18] Nathalie: It's changed a lot over the years. Mostly our understanding of it. I think kind of similar people have been coming to us just based on like, who knows us and who they've recommended it to, and that kind of thing. So we've got a lot of authors and speakers and podcasters, and basically the content creators do come to us quite a bit.[00:18:34] And over the years we realized, okay, the ones who are really doing well are the ones who they have a little bit more of that leverage. They can kind of sell to more people. So that's. Evolved over time. We definitely have people who are more of the, do it yourselfers or who are just getting started.[00:18:47] So that that's great too, but I think our kind of top customer, those people who are a little bit more established and have that credibility and can kind of scale a little bit faster that way.[00:18:56] Matt: One of the questions I have written down from our pre-interview was how you navigate the competition.[00:19:00] And as we're talking, like, I'm thinking about. Like boy I don't know if you compete against anybody in the WordPress space, just because of your positioning, your brand value statements and who you, who you're serving now as customers. Do you find yourself competing with more WordPress or more SAS based or is it just a, a good 50 50 mix?[00:19:18] Nathalie: Yeah, it's a little bit of a 50, 50 split. I would say. We definitely could be more with like Kajabi and teachable and Thinkific for the most part. But we also have a little bit of competition on the WordPress side too. It just depends on like what people are familiar with when they find us. So a lot of times if they aren't familiar with WordPress and they've probably looked at LearnDash or number press or lift your LMS or something like that.[00:19:39] So they're kind of familiar more with that. Or if they're kind of. Sort of, they don't quite know what they're doing, but they just know they want an online course and they might have already looked at Kajabi or teachable or Thinkific. And so they'll kind of compare us very differently based on their background and kind of where they're coming from.[00:19:55] So we do have a lot of developers who are more comparing us to WordPress versus business owners themselves tend to compare us more to the class.[00:20:03] Matt: Yeah. If you grew up in WordPress and you only knew of the WordPress LMS plugins, you'd be like, yeah, it's a decent size market, but then once you get into like these SAS based businesses I'll keep the name.[00:20:15] I won't say the name, but I worked with a hosted LMS. It wasn't really even an LMS. It was just a membership. It had nothing to do with like learning modules or structures or anything like that. It was just a membership site. I'm trying to say this without revealing who it is, there was nothing wrong, but yeah, so it was like this blanket membership thing.[00:20:34] And it served all kinds of anyone. And I, I talked to this person and I heard what they were doing for revenue. I was like, Wow, the space is that big. Like, I can't even imagine what these other platforms that are doing that have, like, hyper-focused got great product, great marketing after this person had anything wrong, but it just made me and my eyes wide of like how big this market is.[00:20:57] Do you have a sense? Of how large the market is numbers wise for outside of the WordPress LMS[00:21:03] Nathalie: world? Yeah, so I don't know the exact numbers, but I know that sort of the LMS, like in general market is like billions of dollars and just continues to increase year to year. So it's definitely growing and obviously like with COVID and like a lot of things have changed more and more in the online direction.[00:21:20] So. Only going to keep growing in my opinion. But yeah, I don't know the exact numbers for each individual businesses, but I know that, some businesses are going public or, so there's definitely a lot of growth in this space. For sure.[00:21:33] Matt: You said you started a business with your husband.[00:21:35] Labeled co-founder too, or just painting.[00:21:40] Nathalie: He's definitely my co-founder, but I would say he is more like head of engineering and just focused on development and kind of making sure that that sort of thing is solid[00:21:49] Matt: with everything that's going on. With, COVID weird to say, cause we're like for two years, I feel like we're going two years into it, 20 years into it feels like, but at least in the podcast world, we saw a huge rush to private podcasting company.[00:22:01] Only podcasting a way to communicate internally with your organization instead of just video calls all day long. I'd imagine there's a market there for you where people started knocking on the door saying, Hey. It w maybe we don't want to sell this, but we need software that structures education to our organization out.[00:22:18] Do you feel like you're at a point where maybe having a sales team knocking on enterprise doors and like playing that game, is that something that you're interested or exploring or already doing?[00:22:28] Nathalie: That's a great question. So we do have one person on our team who's in sales, but we haven't done as much of the outreach piece.[00:22:34] So that is definitely something that is kind of. I think on our horizon essentially so far, we've been just working with the market that we know and kind of just building for them, but there's definitely a lot more potential for where we can go. And we're actually just trying to figure out like what what that looks like and kind of what, what those, like other verticals might be as well.[00:22:54] Cause we are trying to just stay focused just because I think that's easier to grow, but once we've kind of figured this out, then I do think we can kind of open up to the other verticals.[00:23:03] Matt: Is this a fully bootstrap business? Or do you have investors that salesperson when, what is their responsibilities now?[00:23:11] Is it just answering questions? Inbound questions. Does he, or she like structure custom agreements extra support, that[00:23:18] Nathalie: kind of thing at the moment, it's basically she does demos. She'll do some of those onboarding calls. So it is half, I would say customer support, half sales in that way. And then we have marketing that does more of the, like getting people to book those demos and kind of come to the website and all of that.[00:23:34] But yeah, that's something that we're like definitely like all eyes and ears open for how to, how to do that slightly[00:23:39] Matt: differently. Have you had any requests from bigger enterprises or brands, could pay more than a hundred bucks a month?[00:23:46] Nathalie: I have we've had some clients and part of it is like sometimes like a school would be interested, but then we, there's a couple of things that don't quite work.[00:23:55] Either. Have certain requirements and that we're not quite fast enough to be able to like, get up to speed on what they're needing. So we, like, I think it's kind of that tricky thing is like, we built it really for entrepreneurs. So when we have different types of institutions that come to us we might not have exactly, exactly what they want, but we have like 80% of what they want.[00:24:12] So this is kind of the, the balance of what we're working[00:24:15] Matt: on for sure. Put a an identifier on whether or not that's like a feature that you don't have, or like an administrative thing you don't have like SOC two compliance or something. Ridiculous.[00:24:28] Nathalie: Yeah. A lot of times it's like SCORM type stuff and like more more things that I don't personally have as much experience.[00:24:35] Yeah. Even just having a conversation about it is kind of like, okay. Tell me exactly what that means. It gets a little bit tricky versus where if they're talking to someone who has that experience, they're just going to be like off to the races with that. Yeah.[00:24:47] Matt: Yeah. It's another lesson. Again, just looking at your site and listening to you and how you position yourself.[00:24:53] Like, there is lots of opportunity there. And, and for other folks who are listening to this in the WordPress space, 90, but I don't wanna say 90%, but 70% of the time, like when a big enterprise knocks on your door, Your price could literally be 10 X, what you're charging now. And it has nothing to do with the features.[00:25:13] It is the time that it takes to sell them. Right. It's just the sales process. It literally like six months to a year for most of them. And then it's all this administrative stuff back and forth. And then it's your terms. How can we pay you? Right. And. People are like, wait, we don't have a credit. We're not going to give you a credit card for a month.[00:25:32] We want to pay for three years. Like, where's the, where's the legal ease around that. And it's like, if you just had like all of this templated purchasing or procurement structure in place, you could be off to the races without even adding features. And in fact, I'd say features ends up being. Down the totem pole because a marketing person gets excited and they're like, yeah, this is a great product.[00:25:54] Oh, by the way, here's the procurement team. And then you're just like, oh shit, I got to go through legal now than I have to go through InfoSec, and then I get to talk to like the CFO and they get to talk about like, structuring a contract. So, again, no real question there, but just from my own experience, like I think WordPress can do WordPress products can do better by satisfying some of those needs that just doesn't have anything to do with.[00:26:15] At the end of the day. Yeah, absolutely. You your husband to support people? I heard the sales person. That's five, a marketing person is six. How much more on the[00:26:27] Nathalie: team? Actually two marketing people right now. One person who is in people ops, and then we have two development interns as[00:26:36] Matt: well. Nice. How do you recruit the interns locally?[00:26:39] Nathalie: Yeah, so they're at the university of that. My husband and I both went to, so they have a really great program. That's like a co-op program. So we basically just post and interview and hire and it's been going really well.[00:26:50] Matt: Yeah. I would definitely say a lot of that. Some agencies and product people should definitely look locally.[00:26:55] For developers, especially in that sort of intern phase, it's great to sort of educate people locally and pray to God. They stay, don't leave the area when they graduate, because where I'm from, they leave the area when they graduate and we lose that, that great talent. When you started, how big was it?[00:27:08] Nathalie: When I started, it was just me, my husband, and an[00:27:11] Matt: assistant any, and this was going to be a broad question. Thoughts on hiring people, growing the team? What was that? Was that stressful at all? Turbulent at all?[00:27:22] Nathalie: Yeah, it was a huge learning curve. So I feel like some of our best hires we figured out. A little bit late was it was already in our community.[00:27:31] So they were already, super fans or maybe they were building websites for people using our plugin. And so they already have the talent and the know-how and he just had to like recruit them. And that, that was a big learning curve because we were posting on these very broad job boards and finding people who were just looking for a job and they don't really care about us.[00:27:50] And so when something else comes along, The end. So, that was a big kind of ruining her for us. And yeah, we're doing a lot in that, in that way. Like how can we nurture our community? How can you make their lives easier and better? And then, if they're ready for a different kind of position that fits what we're looking for, then yet we're definitely super excited about.[00:28:09] Matt: Yeah. Yeah. The whole, like, I don't know if you hear it, but I've heard it before I started or when I was starting my businesses, like hire slow fire fast and I'm like, yeah, Yeah, you just got to laugh at that. I'll be like, I just need people now. Like I don't have time to slow this process down. And then you realize that six months into it, you're like I pick the wrong person or this or this person picked the wrong place.[00:28:32] And now what do I do? And that is so true. I mentor at a local accelerator in the, and it's a nonprofit accelerator for sustainable businesses in my area and the company that I'm mentoring. Now, they're trying to launch a nonprofit for daycare for disabled children. And. They're raised. They're, they're trying to figure out how they're going to get money.[00:28:51] And they're talking about grants and funding and all this stuff. And they're like right out of the gate, we want to hire 10 people and I'm like, man, that's going to be tough. Like you don't like that process of just getting people in, especially 10 of them is going to take you. It's going to take a thousand people to talk to literally quite literally to get these 10 perfect people in the door here.[00:29:11] And it's, it is not easy. What's the next role that you think you'd be hiring?[00:29:13] Nathalie: We're actually hiring right now for a product manager and that's sort of. Me cause I've been head of product for quite a while. And it's great because I talk to our customers a lot. So I kind of know what they were looking for and how to build what they want.[00:29:27] But I also know I could be doing other things too. So it's kind of just freeing myself up a little bit so I can do more of the marketing and the sales and kind of the things you were talking about, like, okay. Like what's next, like lifting my head up a little bit and yeah.[00:29:39] Matt: Looking bigger picture. Is that where you would focus more on marketing sales?[00:29:42] If you were to alleviate[00:29:44] Nathalie: yourself? It, yeah, more marketing and sales, more interviews like these, more things like that where I can be a little bit more publicly visible and kind of get the word out for access to LA. Yeah.[00:29:55] Matt: Let's talk about the marketing side of it. How, without giving away the secret sauce, what, what has been your best approach to reaching these customers?[00:30:03] Previously you built your own audience. I assume you still leverage that same audience. What other areas are you getting into or how are you expanding that?[00:30:11] Nathalie: Yeah. So a lot of, I think my success is from list-building and building that community in the beginning and just having a lot of alignment with what they wanted and also like what we were offering.[00:30:22] And so we've done so much in the list, building realm, like we did a free challenge, we've done a like free, essentially a free video course where people like opt in and then they get a free video every day for 30 days. And that was probably. Lead magnet that was so super successful. And then, yeah, like, YouTube podcasts I've pretty much done all of the marketing things and kind of took a break for the past year and a half just because I had a baby and then obviously pandemic and so many things happened, but yeah, I feel like there's so much in the space of marketing that works really well.[00:30:52] I will say I don't tend to jump on. Like flashiest things. So I deleted my Instagram account. I'm not on Tik TOK, I'm not doing it clubhouse. Like I know there's been quite a few trends of like new platforms and new things, but I try to stick to things that work long-term. So for me, that's like SEO, YouTube videos.[00:31:09] Like those are the kinds of things that once you put it out there more and more people will find them over time. So to me, that is a really good long-term kind of investment on the marketing.[00:31:18] Matt: Yeah. Yeah. I find Instagram to be challenging personally myself, even though I shouldn't, I just like podcasts, you should be able to, like flex in that area.[00:31:27] Is that what the kids say on Instagram? Like flex in that area and it should work well, but it doesn't, especially on like the WordPress site. It's like, there's nothing really flashy. That's going to be like excited. Like here's a picture of the dashboard with a filter on it. Like, what are we going to do here?[00:31:40] I get so jealous when I look at like other companies and other brands, right. Cool, like collabs, like backpacks, collabing with like these other makers or creators, like, ah, it's such an awesome way. You can't do that with WordPress is nothing there. It's fun and exciting. It's a challenge for sure.[00:31:54] What about you hinted before. That maybe you kind of explored the world of SAS. I know you said you wanted to be hyper-focused or you are hyper-focused even if it wasn't full on SAS, would you go and kind of pivot to supporting a Drupal or Joomla or another platform at all? Is that anywhere on the radar, SAS or otherwise?[00:32:14] Nathalie: Not so much the other off of WordPress. If we were to do more of a SAS, we would probably just take WordPress and host it and kind of do it. Like plug and play one click button. Your site is ready kind of thing. Which I know other platforms like Rainmaker have done, like they took WordPress and they sort of, Close it off a little bit.[00:32:32] So that's something we thought about and we've tested doing like hosting with the seam and things like that in the past. But also we know that our people tend to be power users and they want to be able to install other things and kind of make it work with other stuff. And that's kind of the beauty of WordPress.[00:32:45] So we don't want to like cut off the best part. So yeah, we kind of, we explore it like almost every year. We're like, what about now? What about now? But I don't think it's really the right move.[00:32:56] Matt: Yeah. Yeah. What about this is also kind of marketing kind of product, but what about partnerships in the WordPress space?[00:33:05] Advice or success that you've seen or not that you've seen in the space that you can speak towards partnering other plugins and, or e-commerce plugins or marketing plugins or anything like that.[00:33:15] Nathalie: Yeah. There are certain plugins that are positioned to do amazing things in terms of partnerships. So I know like WP fusion is an amazing one that they work with so many different things.[00:33:25] And so we've integrated with, with them. And there's a couple of other plugins that we've integrated with. But I would say our biggest integration partners are actually the CRMs and the email marketing systems that we integrate with. So they're kind of outside of WordPress, but we do integrate tightly with them.[00:33:38] So that gives us that ability to like co-market with them. And we're all listed on their websites and stuff as an integration options. So that has been really nice for us too. And people who are really looking for something that deeply integrates with that, they tend to come to us because of that. So.[00:33:53] Yeah. I almost feel like WordPress is awesome. And also there's other tools that most people are using. So just thinking about at that level too. So for example, we don't have an integration with zoom, but we used to have an integration with Google Hangouts. And so we would have, people could start a Google hangout from inside their membership site.[00:34:10] And so I think that's something too it's like, how can you connect to things outside of WordPress? Sometimes that people use a lot as well. So those are some, some things we've done in the past and some things that are still working well for[00:34:20] Matt: us, this seems to be a recurring. Trend in my last few interviews.[00:34:25] Is is integrations. Ad-ons, when to make those there's a million places you probably want to integrate with, I'm sure there's a million people who have requested things to integrate with. How do you find that balance? Because at the other end of it, and people are probably sick of me saying this already.[00:34:41] Is there is that the, the overhead of an integration that just doesn't become as popular as you thought it was going to be MailChimp, even though MailChimp's popular, let's just say MailChimp fell off the face of the earth. Then it's like, man, I got a half a dozen people over here using MailChimp and I still get to support this.[00:34:55] Add on how do you make the decision on when to support one or when to make one? And co-brand with one, two at the same time. Yeah.[00:35:03] Nathalie: So we currently integrate with five different email marketing systems. And the first one, we just build it for ourselves. Like, like I said, so that one was an easy, easy. Yes. And then after that, we looked at their biggest competitor essentially.[00:35:16] And so we went with that one and then. We noticed a trend where a lot of people were switching from both of these two to a third one. So then we integrated with that one. And then the next two are kind of just, they were all being compared a lot. So that kind of made sense to integrate at that time.[00:35:30] But yeah, we have, we have people constantly asking us to integrate with new payment systems and some people maybe in Europe can't use certain systems or in other parts of the world where they can't use Stripe, for example. So we definitely get a lot of. And I think it's exactly what you said.[00:35:46] Sometimes it comes down to numbers and if we've only had one person ask for it, like, I'm sorry, it's just probably not going to have it right now. And also integrations do change, right? So they changed their API and then we have to test and maintain and make sure it still works the way that promised or, that used to at least.[00:36:01] So that's been a bit of a trick. The situation over the years, because as those companies that we integrate with change and mature we have to kind of keep up with that. So that's definitely been a bit of a tricky thing. And we do have a whole backlog of integrations that people have asked for.[00:36:14] And we did keep our ears open. We keep track of each person that asks for it. And then when the numbers kind of tick up high enough, then that's kind of, usually when we pull the trigger on them,[00:36:22] Matt: I'm looking at the integration page now. I actually don't see a MailChimp. Has MailChimp not been requested or you just refuse to support the monkey?[00:36:29] Ah, yes.[00:36:30] Nathalie: So we've had a lot of people ask for it. I've never[00:36:32] Matt: said that on the air before it refused to support the monkey. I don't know where that came from, but sorry, go ahead.[00:36:36] Nathalie: That's hilarious. Yeah, no, we've definitely had. For MailChimp and our reasoning for not integrating so far is that they didn't have the functionality that we needed in terms of tagging and automation.[00:36:47] So we tend to integrate with the kind of more advanced CRM that do a lot of like cool things. And that basically think back to access LA after. And I know they've added a lot over the years, so we're probably gonna be revisiting, revisiting that again soon, but yeah, for now yeah, there's definitely people who've asked for it and.[00:37:02] Matt: I noticed that the footer there's a page called discover experts. Find an expert. I forget the title of it. It looks like there's a 20 ish or so maybe more if I actually filtered through and started searching how does this program work and what have been the, the positives and negatives of trying to build something like this off the ground, get something like this off the ground, because I know it's difficult to wrangle folks together to really get something of value here.[00:37:30] Yeah.[00:37:30] Nathalie: So we started our certification program. I think it was. Six years ago. So, it's been quite a few years in the making and the first round of it was in person, you had to fly out, we taught you everything there was to know about access ally and building sites and really kind of digging in. And it was a huge, it was a $10,000 program to sign up.[00:37:51] So it was definitely like, you're jumping in all in and that commitment level kind of connected with the people who were ready for it. So that really jumps start the program. And, a lot of those early people have had, hundreds of clients sent their way because of, being early adopters and kind of pioneering some of the things that we did with them and giving us feedback to improve the product and all of that.[00:38:11] So that's kind of how it started and then it's really kind of shifted over the year. So now it's an online things, so they don't have to come and fly out and meet us and learn the software. We actually teach them online. And basically what we do is we. Make sure they're really great at what they do.[00:38:25] And then we kind of filter them out based on what they're focused on. So some people only work with one CRM, that's their jam. They're super awesome at it. Other people love to do the design aspect of the site. Other people are more on the course development. So how to design the course in like the content and modules and all of that.[00:38:41] So we kind of have people doing different types of things. So we know kind of who to recommend when somebody comes to us and doesn't want to do their own setup and do all that.[00:38:49] Matt: Yeah, that's fantastic. And putting a price tag on it is very smart and I'm just like thinking in my head, how can I, how can I do that too?[00:38:58] Like, that's such a, that's such a great idea. I I've, I've, I've known about obviously certification programs. A lot of them again, when you're looking at the top it's it's, it's all paid. I again, when I look at the things happening in WordPress, because we're so I don't want to say desperate, but we're just so like desperate to get people excited.[00:39:14] We're like, just any, if you could fill out this form, you're a partner. Like if you can get through the capture, you win. They're like, okay, that's the bar we're setting for ourselves. But no, it's great that it's paid. And then, obviously don't have to tell you, but once people are paying for it they're spreading the word.[00:39:29] They want you to succeed. You want them to succeed and it's just those positive inertia in, in that direction. So that's fantastic. That's great to see that, that program, that program working before we hit record, you mentioned that you have a F potentially a new theme coming, anything that you can hint at about that release and why you started to be.[00:39:48] Nathalie: Yeah. So we've actually been working on it for about a year, which is like insane, but it's one of those things where we wanted it to be just right. And there's a lot of options for themes and builders and like Burke and so many things that people can choose from to make their sites look great. And the reason we decided to do our own theme is really just menus.[00:40:07] I know it sounds so simple, but when you have a course and you have our multiple courses with a different menu on each course, it's a lot of work to set up those menus on all those pages and. So that's kind of one of the biggest benefits it will save then you access LA theme. And then it also integrates with all the progress tracking.[00:40:23] So you can kind of see, like, as you're going through like little check marks show up beside your menu and you have your little progress bar that shows you how far ahead you are in a course or program. So we just wanted to make it easier for our customers to make things that look great out of the box if they don't want to hire a designer.[00:40:38] So that's kind of our thinking with that.[00:40:40] Matt: Yeah. Yeah. That's no, that's great. That'll be a huge, I'm sure, again, and just from my work with other LMS plugins, that's, that's always the hangup. It's like, I've got this perfect theme and it serves like all of my marketing and how I want my blog to look and how I want my homepage to look.[00:40:55] And then you install the LMS and it's like, that is the ugliest progress bar I've ever seen in my life. No, it looks like, I don't know what it is like this looks like a geo city site that I built, 30 years ago. Why is it looks so terrible is because it's not styled for it. Right. And it's, that's a huge crux of WordPress and plugin integration.[00:41:13] Are you excited about anything Gutenberg related? That's going to make your life easier for the plugin, for the theme.[00:41:19] Nathalie: Yeah. I really want to love Gutenberg and I think it's getting there, like, no, no, I really think it's we're close. And I think that a lot of people had a lot of. Emotions, let's put them around.[00:41:32] And and I think that we're really, really like if we're not there yet, I think we're like super close to actually having that. So we're actually going to be recommending people, use Gutenberg with theme. So if people don't have another option that they prefer, and I think that's going to be really amazing.[00:41:46] So XSL, it comes with blocks already, so it can do all the things that it needs within that area. I like kind of your main part of your content for your courses and stuff. So I'm super excited about that. And it's actually something I want us to go into more, like, I think that's direction. I really want the plugin to go into Morris, making the blocks even better.[00:42:03] So yeah, I'm definitely all in on Gutenberg, but I think that there's still a lot of resistance from people who are more familiar with it, or maybe haven't played enough with it and feel a little bit of that. Yeah, not too sure about it yet.[00:42:17] Matt: Yeah. In the beginning, everyone was sort of just, throwing their hats off saying why, why, why, why, why do we have this?[00:42:23] But you know, over, over time, like we all should have known like any soft first version of a piece of software. You, we all know it's not, it's not the, the version we are really gonna fall in love with. And it's taken a few years. I certainly enjoy it, but yeah, there's still some things where I'm just like, I literally can't drag this block into a column.[00:42:42] Like the most basic thing I should be able to do ever. I can't do those are some frustrating points and then there's some other awesome points. And I was making a landing page for, at castles today. And, and like the quick commands of like the forest lash and you just hit I, and an image pops up or P for power, like that stuff navigating that is it's fantastic.[00:43:06] Like, it just makes that stuff so much easier, but yeah, there's still some pain points and I think, I think it's going to be another year, maybe two until it's really smooth, especially with full site editing.[00:43:18] Nathalie: Right? Yeah. I feel you on that. And I think it's like, just. Keeping the hope right. That we'll get there and like, just keep them at it, keep it going and just putting our support behind it too.[00:43:29] I think as business owners, we have to say like, no, this is the direction we're presses going in. And we have to put our support behind that too. So that's. Yeah,[00:43:38] Matt: for sure. Natalie Lucier is founder and CEO access. ally.com checkout access, ally.com. If you haven't, if you have a customer or a client or you want to launch your own LMS, check out access, ally.com, Natalie, anywhere else you want folks to go to say thanks.[00:43:52] No, that's[00:43:53] Nathalie: that's fine. Thank you[00:43:55] Matt: stuff, everybody else. My report.com my report.com/subscribe. Join the mailing list. And if you want your weekly dose of WordPress news and under five minutes, the WP minute.com. ★ Support this podcast ★

An airhacks.fm conversation with Graeme Rocher (@graemerocher) about: Playing games with 286, playing digger, starting programming with quakec, programming custom explosions for rocket launcher with "shockman", working for a Apache Cocoon company, JavaScript and Java as second languages, programming learning management SYSTEMS with Java, publishing motivated by learning, programming over gaming, using JBoss on the backend, extracting content from Word with Apache POI and Groovy into XML, using XSLT to convert XML into HTML, data driven templates with XSLT, data-driven stylesheets is the way to go, starting with Visual Basic, the raise of Ruby on Rails, starting Groovy on Rails--Grails, groovy and the "method missing", "method missing" was heavily used in gorm, working on SpringData, SpringData and GORM are similar, joining Object Computing, staying small and be successful, with reflection you will use more memory at the runtime, micronaut was started by Graeme Rocher, micronaut is based on annotation processing, there is no "mobile native" development, on Android reflection is not used, better error messages was one of the design goals, micronaut comes with annotation-based introspector, micronaut generates a reflection-like API based on annotation processors, micronaut was announced in March 2018 and opensourced in May 2018, CDI was hard to implement without annotation, micronaut is similar to Spring, micronaut supports JSR-330 and is TCK-compliant, the Bean Validation module, micronaut supports micrometer, micronaut teams grows at Oracle, Visual Studio Code ships with GraalVM Extension Pack and Micronaut support, micronaut and Helidon are developed by multiple teams, Oracle actively supports micronaut, micronaut and GraalVM are great fit, micronaut is complex at compile time, but simple at runtime, helidon will be able to use the Micronaut Data, the JAX-RS with micronaut screencast, Object Computing, Google, Oracle are contributing to micronaut, Graeme Rocher on twitter: @graemerocher

Doug Tidwell is the Senior Technical Marketing Manager at Redis Labs where he is currently working to build out the Redis Labs Developer Program. Redis Labs is the home of Redis, the world's most popular in-memory database, and commercial provider of Redis Enterprise. Doug is also a programmer and writer who creates videos, articles, sample code, container images, and other useful things. He has given hundreds of presentations at dozens of conferences around the world and is the author of O'Reilly's XSLT, a copy of which makes a perfect gift for all occasions. In a conversation with Pranav, host, Mad over videos podcast episode 23, Doug shares his insights on creating humorous marketing videos to open new doors, create an affinity, and leave a lasting impact on your target audience. We've also covered video-based evangelism, how to speak to developers effectively, and a lot more. So without further ado, tune in to learn more such interesting video content, marketing insights only on the Mad Over Videos Podcast episode 23 featuring Doug Tidwell of Redis Labs. WEBSITE: guch.me/ LINKEDIN : @guch www.linkedin.com/company/guchme/ INSTAGRAM : @guch.me www.instagram.com/guch.me/ FACEBOOK : @guchHQ www.facebook.com/guchHQ TWITTER : @guchHQ twitter.com/guchHQ

An airhacks.fm conversation with Lukas Eder (@lukaseder) about: a Unisys 8086, don't break your dad's computer, playing with "format", starting with QBasic and 12 years, serial cable chat programs in QBasic, Turbo Pascal with 15, changing the font in the BIOS, starting CMS with PHP and MySQL, no transactions, no connection pools in PHP, the beginning with serverless and CGI, Java is not a website technology, Java static pages vs. PHP includes, enterprise PHP: Zend Framework, from PHP to Java, PHP 4 to PHP 5 migration and the assignment operator, enjoying Java 1.3, Ant vs. Maven 1, a reporting project for a telco company with Java and Hibernate, writing backends in SQL and frontends with XSLT, stateless, functional programming with XSQL and SQL, jooq manual was built with XSLT, apache Cocoon and XSLT, Servlets and Java Message System (JMS) with WebLogic, from Hibernate query builder to jooq in 2006, cascading interfaces which feel like SQL, everyone built a query builder, rewriting jooq - jooq2 in 2008, queryDSL - the abstraction across multiple query language, jooq only abstracts SQL, dynamic "where" clauses with criteria query, jooq stands for: j-object oriented query, jooq started with stored procedure support, SQLJ the preprocessor, PRO-C* -> the C preprocessor for Oracle to generate boring glue code, jooq 1 was a procedural query builder, jooq 2 DSL API looks like SQL and uses the query builder layer, the database first design, SQL is not composable, SQL: different syntax on different levels, 1000 lines of jooq code is not unusual, DSLContext - the starting point, commercial support for jooq is available, database migrations with jooq, opensource vs. commercial edition, dependency on products, saving costs with opensource, focus on Jakarta EE, Java EE, MicroProfile API vs. direct runtime dependencies, working with dynamic SQL and jooq, database vs. Java first Lukas Eder on twitter: @lukaseder

An airhacks.fm conversation with Ken Finnigan (@kenfinnigan) about: Commodore 64 in 1984, Commodore 128D in 1986, creating a Star Wars game, approaching the dark star, a Gateway XT with 20 MB hard drive and 640kB RAM, playing with DBase IV, Lotus 1-2-3 and Delphi, implementing software for baseball statistics in 1989, surviving a Giants game in San Francisco, learning C++, Modula 2 and assembly programming at university, the JavaONE session marathon, learning Java in 1999, enjoying Java programming, starting at IBM Global Services Australian, introduction to the enterprise world with PL 1, Job Control Language (JCL), AIX, CICS and CTG, starting to work with Java 1.2 at an insurance company, building a quotation engine in Java, wrapping JNI layer to reuse legacy C++ code, creating the first web UIs with Java with JSPs and Servlets, PowerBuilder and Borland JBuilder, enjoying the look and feel of Visual Age for Java and JBuilder, Symantec Visual Cafe for Java, Sun Studio Java Workshop had the worst look and feel, writing backend integration logic with XSLT and XML in Dublin, Apache FOP and Apache Cocoon, XSLT transformations in browser, enjoying the marquee tag, using SeeBeyond eWay integration in London, switching to chordiant Java EE CRM solution, using XDoclet to generate EJBs, from XDoclet to annotations, wrapping, abstracting and Aspect Oriented Programming framework, it is hard to find business use cases for AOP, J2EE already ships with built-in aspects, enterprise architecture and UML, using IBM Rational Software Modeler for architectures, driving a truck with tapes as migration, the Amazon Snowmobile Truck, never underestimate the bandwidth of a truck full of hard disks, "Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway", Andrew S. Tanenbaum, building stock trading platform in Sydney with J2EE, Complex Event Processing (CEP) with J2EE and JBoss, attending JBoss World in Florida and meeting Pete Muir, starting with Seam 2 to write a CRM solution for weddings, contributing to Seam 3, creating annotation-based i18n solution, joining RedHat consulting, migrating from Oracle Application Server to JBoss EAP 5, joining RedHat engineering, leading portlet bridge from JBoss Portal project, starting project LiveOak, apache sling, starting project WildFly Swarm with Bob McWhirter, WildFly Swarm vs. WildFly, WildFly Swarm and WildFly - the size perspective, WildFly Swarm supported hollow jars, hollow jar allows docker layering, WildFly Swarm was renamed to Thorntail, Thorntail 4 was a rewrite of the CDI container, Thorntail 4 codebase was used in Quarkus, Quarkus is the evolutionary leap forward, Quarkus observability and micrometer, working with OpenTelemetry, OpenTelemetry and micrometer, OpenCensus, Eclipse MicroProfile and Metrics, micrometer vs. MicroProfile metrics, GitHub issue regarding custom registry types, airhacks.fm episode with Romain Manni-Bucau #79 Back to Shared Deployments, starting with counters and gauges in MicroProfile, metrics in a Java Message Service (JMS) application, MicroProfile metrics could re-focus on business metrics, services meshes vs. MicroProfile Fault Tolerance, Istio is only able to see the external traffic, implementing business fallbacks with Istio is hard, OpenMetrics and OpenTracing are merging in OpenTelemetry, MicroProfile OpenTracing comes with a single annotation and brings the most added value, Jakarta EE improvements are incremental, Java's project leyden, the MicroProfile online workshop, Jakarta EE and MicroProfile complement each other, GraalVM and JavaScript, pooling with CDI is challenging, MicroProfile as layer on top of Jakarta EE, the smallrye first approach Ken Finnigan on twitter: @kenfinnigan, Ken's blog: kenfinnigan.me

This is a great crash course on just-in-time compilers written by Lin Clark, who works in advanced development at Mozilla on Rust and Web Assembly. It references the film Arrival and kicked off our discussion on the podcast. Paul talks about his first love, XSLT, and how that language actually foreshadowed a lot of what would become popular staples of modern programming languages. Sara and Paul share their thoughts on what it takes to craft a new language as a programmer and why they have never embarked on this arduous intellectual adventure. This brought to mind a well written essay from one of the creators of Redis, who is stepping back from managing the project to work on something new. Here is, in my opinion, a profound quote from that piece: "I write code in order to express myself, and I consider what I code an artifact, rather than just something useful to get things done. I would say that what I write is useful just as a side effect, but my first goal is to make something that is, in some way, beautiful. In essence, I would rather be remembered as a bad artist than a good programmer."Our lifeboat badge of the week goes to Farhan Amjad, who answered the question - How can I implement PageView in SwiftUI?  

This is a great crash course on just-in-time compilers written by Lin Clark, who works in advanced development at Mozilla on Rust and Web Assembly. It references the film Arrival and kicked off our discussion on the podcast. Paul talks about his first love, XSLT, and how that language actually foreshadowed a lot of what would become popular staples of modern programming languages. Sara and Paul share their thoughts on what it takes to craft a new language as a programmer and why they have never embarked on this arduous intellectual adventure. This brought to mind a well written essay from one of the creators of Redis, who is stepping back from managing the project to work on something new. Here is, in my opinion, a profound quote from that piece: "I write code in order to express myself, and I consider what I code an artifact, rather than just something useful to get things done. I would say that what I write is useful just as a side effect, but my first goal is to make something that is, in some way, beautiful. In essence, I would rather be remembered as a bad artist than a good programmer."Our lifeboat badge of the week goes to Farhan Amjad, who answered the question - How can I implement PageView in SwiftUI?  

It's weekly update time!! As always, we've worked hard to listen to what you'd love to see in Captivate and have put together the latest release as follows... XSLT stylesheets: RSS feeds are dull as dishwater. But, they power podcasting and sometimes, you pop your RSS feed into the browser and see the feed is all its gargantuan glory - code and all. That's ok, it's how it's supposed to be, but we wanted to make it easier for anyone stumbling across your feed in a browser window to know exactly what to do with it and to be able to listen to your show directly from the feed. So we sexy styled it up. Look:  https://feeds.captivate.fm/podcastaccelerator (https://feeds.captivate.fm/podcastaccelerator) Behind the scenes service tech: We spent a day or two building a new backend area for us to link your Captivate account to Intercom via a secure Intercom widget. Sounds boring, and it is a little bit, but it means that we can support you even faster by seeing right there in the support chat with you which show you're working on and quickly launch that show in Captivate's dashboard for us to take a look at. I love it!  Stay safe! 

GUEST BIO: My guest on today’s show is an internationally recognized author, speaker, blogger and sometimes teacher and consultant.  He has been working with the web since late 1993 and is recognized as an expert on the subjects of HTML, CSS and web standards.   He is currently a technical lead at non-profit organization Rebecca’s Gift and is also co-founder of An Event Apart, a web design conference for UX and front-end experts.   EPISODE DESCRIPTION: Phil’s guest on today’s show is Eric Meyer. He has worked in the IT industry for more than 25 years. Today, he is a teacher, designer and consultant who is a recognized HTML, CSS and web standards expert. He also has a working understanding of XML, XSLT, JavaScript, and related technologies. Eric is also the technical lead for the non-profit organization Rebecca’s Gift and the co-founder of An Event Apart, an interactive conference targeted at designers, developers and front-end experts. He is also the author of several CSS books and the founder of the css-discuss mailing list, as well as a conference speaker. KEY TAKEAWAYS: (1.14) – The very first thing I wanted to ask you about really was the non-profit organization Rebecca's gifs. Could you maybe give us some background about that organization and your involvement? Eric explains that his daughter, Rebecca, died from brain cancer, at the age of 6. One of the things that helped him, his wife, and his surviving children to recover was to go on a special trip together. A few months after Rebecca’s death they took a trip that the kids had kind of planned. It helped them a great deal. So, his wife decided to set up Rebecca’s Gift to help other families to do something similar. They help families, who have lost a child, to take their other children on a trip. It provides them with a chance to get away from everything and reconnect with each other. Eric is the chief technical officer for the organization. His wife takes the lead and Eric looks after the website and the technical side of things. (2.23) - Where can people find out about it? The website is http://rebeccasgift.org/. Eric goes on to explain that, currently, they are US-based. But, people can still go to the website, read about the organization and make a submission. (3.07) - So in terms of your other activities, An Event Apart is something else you're very much involved in. Could you maybe give us a bit of an insight into that? Around the turn of the millennium, he and Jeffrey Zaltzman were attending and speaking at a lot of conferences. Unfortunately, the content was not that great. It did not really speak to people like Eric and Jeffrey. They were designers as well as developers who were not interested in simply slamming out websites. Instead, they wanted to create sites that were user-friendly, forward compatible and accessible. None of the conference speakers shared information that was truly relevant to the way they worked and what they produced. So, they decided to remedy that situation. Eric and Jeffrey put together a one day show and took it around a few US cities. People liked it but often said that they wished it was for more than one day. Over time, they have been able to respond to that request and turn the An Event Apart into a 3-day interactive conference. The show is designed to enable developers to explore and for designers to find out more about development. Plus, of course, for those who already do both. They cover the entire spectrum, including UX and information architecture. It is not just about the cool stuff. The essentials like CSS Grid and Flexbox are also covered. (5.26) – How many cities do you expect to be arranging events for, this year? Eric says that by the end of the year they will have done the show in 6 cities. At the time of recording, the Seattle event was behind the team and the Boston event was next on the agenda. With Washington DC, Chicago, Denver, and San Francisco still to take place before the end of the year. (6.18) – Can you please share a unique career tip with the I.T. career audience? Eric explains that there really are no gatekeepers. There is nobody in IT that can make or break your career. Nobody has the power to shut you out of web development. The only person that can stop you is yourself. (7.37) – Can you tell us about your worst career moment? And what you learned from that experience. Eric worked on the Y2K switch over. For a joke, he and another colleague decided to make the university webpage look like it was created in the 1900s when the clock struck midnight. They put together a page using typography from the era and included the message “as you can see the server thinks it is 1900.” They thought it would be fun, but they did not tell anyone what they were planning to do. The page went live, the press got hold of the story and all hell broke loose. This did not go down well with the administration. Eric’s boss was told to fire him. Worse his boss’ manager was told to fire him, as well. Fortunately, neither of those things happened. However, Eric still feels bad about inadvertently putting his boss’ job at risk. (10.00) – What was your best career moment? Eric went to Case Western Reserve University. While he was there two of his professors asked him to put two encyclopedias they had written online. It was a big project, which is really proud of managing. Now, anyone who is interested in the history of Cleveland, Ohio can access a huge body of material and do so for free. (12.40) – Can you tell us what excites you about the future of the IT industry and careers? Eric is really excited about the way CSS Cascading Style Sheets is changing things and the rate at which it is growing. That is what is exciting him about the sector of the IT industry he works in. Looking at things more generally, the fact that people involved in the IT industry are starting to have a conversation about ethics is good to see. Mike Monterio has just published a book about design ethics in which he takes a strong stand. We need to think about the impact doing X can have, outside of the purpose we have built it for. Developers need to ask themselves how what they are creating can be abused. (15.25) – Do you think this will result in new roles within the IT industry? Eric hopes that one day we will see appointing a chief ethical officer becoming the norm. Dumping a load of data into a recursive neural network and hoping nothing goes wrong may be OK in a closed environment, as a way of exploring the possibilities. But, it is not OK to deploy that stuff to the public. You need something in place to make you pause, think about what could go wrong and decide if you should still proceed. (16.44) – What drew you to a career in IT? For Eric, initially, it was the fact that he could make good money. He had been using computers since he was 7, so getting into the IT industry was a natural progression. (17.31) – What is the best career advice you have ever received?  When Eric asked Jeff how he could get to be a conference speaker, he said: “write a book”. Eric did. After that landing speaking gigs was easy. Even if you do not want to be a conference speaker, it is still a good idea to write about what you know. You do not have to write a book to do that. Running a blog is just as an effective way to put yourself out there and let people know what you are about. Eric has known people to be hired because someone liked a blog post they wrote. (18.20) - Conversely, what is the worst career advice you've ever received? One of his managers, at the university, told him to “stop playing with that silly web stuff.” Fortunately, everyone ignored him and carried on learning and working with HTML. (18.49) – If you were to begin your IT career again, right now, what would you do? Eric says he would go to code school or get a degree in computer science. But the biggest thing he would do differently is to focus on finding work that really interested him. So, he could stay engaged enough to dive deep, truly understand things and share what he was learning. When he finally started sharing what he knew, his career took off. Today, he would get involved in GitHub, Medium, and Stack Overflow far more quickly and deeply. (20.02) – What are you currently focusing on in your career? Eric wants to become a better leader. He is also teaching himself more JavaScript, he wants to make sure he can understand the emerging JavaScript technologies. (20.42) – What is the number one non-technical skill that has helped you the most in your IT career? Being an effective communicator is Eric’s most important non-technical skill. He knows he is good at doing it in writing and he is working hard to become just as good face to face. For example, in training situations, when he can see from people’s faces that he has lost them a bit, he now doubles back and explains things differently. (21.26) - What do you do to keep your own IT career energized? Eric finds that rotating through a stable of things that need his attention keeps him engaged and motivated. If he starts feeling a bit burned out, he switches track for a while. Doing something different re-energizes him, enabling him to switch back and start moving forward again. (22.13) - What do you do in your spare time away from technology? Eric enjoys carpentry. He started out doing what they call rough carpentry. For example, he built a coop for his chickens. Now he has some experience, he is getting into finer woodworking.  (23.10) – Phil asks Eric to share a final piece of career advice with the audience. When deciding what tech to learn next, think about what you want to do with it, not what you want to do in it. Ask yourself what interests you. For example, would you like to make servers run faster? Or do you want to connect people? Asking yourself what differences you want to make to the world will naturally point you in the right direction. It will make it easy for you to identify what technologies you need to learn. That is how he and Jeff ended up putting together the An Event Apart conference. They saw an issue, wanted to solve it, so, went out and learned what they needed to know to run their own conferences. When deciding what tech you will learn next, you need to take a similar approach. Learning something with a purpose is always a far more effective and interesting way to learn. BEST MOMENTS: (6.33) ERIC– "There's nobody in IT who can make or break your career other than yourself," (14.35) ERIC– "When people create things, they need to ask themselves, how could this be abused?” (18.26) ERIC– "I know people who have never written a book, but have been hired by somebody because of a blog post they wrote" (21.46) ERIC– "Communication, which people call a soft skill, is one of the hardest to master. It takes practice." CONTACT ERIC: Twitter: https://twitter.com/meyerweb   LinkedIn: https://www.linkedin.com/in/meyerweb   Website: https://meyerweb.com/   Rebecca's Gift: http://rebeccasgift.org/

Byproducts of reading OpenBSD’s netcat code, learnings from porting your own projects to FreeBSD, OpenBSD’s unveil(), NetBSD’s Virtual Machine Monitor, what 'dependency' means in Unix init systems, jailing bhyve, and more. ##Headlines ###The byproducts of reading OpenBSD netcat code When I took part in a training last year, I heard about netcat for the first time. During that class, the tutor showed some hacks and tricks of using netcat which appealed to me and motivated me to learn the guts of it. Fortunately, in the past 2 months, I was not so busy that I can spend my spare time to dive into OpenBSD‘s netcat source code, and got abundant byproducts during this process. (1) Brush up socket programming. I wrote my first network application more than 10 years ago, and always think the socket APIs are marvelous. Just ~10 functions (socket, bind, listen, accept…) with some IO multiplexing buddies (select, poll, epoll…) connect the whole world, wonderful! From that time, I developed a habit that is when touching a new programming language, network programming is an essential exercise. Even though I don’t write socket related code now, reading netcat socket code indeed refresh my knowledge and teach me new stuff. (2) Write a tutorial about netcat. I am mediocre programmer and will forget things when I don’t use it for a long time. So I just take notes of what I think is useful. IMHO, this “tutorial” doesn’t really mean teach others something, but just a journal which I can refer when I need in the future. (3) Submit patches to netcat. During reading code, I also found bugs and some enhancements. Though trivial contributions to OpenBSD, I am still happy and enjoy it. (4) Implement a C++ encapsulation of libtls. OpenBSD‘s netcat supports tls/ssl connection, but it needs you take full care of resource management (memory, socket, etc), otherwise a small mistake can lead to resource leak which is fatal for long-live applications (In fact, the two bugs I reported to OpenBSD are all related resource leak). Therefore I develop a simple C++ library which wraps the libtls and hope it can free developer from this troublesome problem and put more energy in application logic part. Long story to short, reading classical source code is a rewarding process, and you can consider to try it yourself. ###What I learned from porting my projects to FreeBSD Introduction I set up a local FreeBSD VirtualBox VM to test something, and it seems to work very well. Due to the novelty factor, I decided to get my software projects to build and pass the tests there. The Projects https://github.com/shlomif/shlomif-computer-settings/ (my dotfiles). https://web-cpan.shlomifish.org/latemp/ https://fc-solve.shlomifish.org/ https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/ https://better-scm.shlomifish.org/source/ http://perl-begin.org/source/ https://www.shlomifish.org/meta/site-source/ Written using a mix of C, Perl 5, Python, Ruby, GNU Bash, XML, CMake, XSLT, XHTML5, XHTML1.1, Website META Language, JavaScript and more. Work fine on several Linux distributions and have https://en.wikipedia.org/wiki/TravisCI using Ubuntu 14.04 hosts Some pass builds and tests on AppVeyor/Win64 What I Learned: FreeBSD on VBox has become very reliable Some executables on FreeBSD are in /usr/local/bin instead of /usr/bin make on FreeBSD is not GNU make m4 on FreeBSD is not compatible with GNU m4 Some CPAN Modules fail to install using local-lib there DocBook/XSL Does Not Live Under /usr/share/sgml FreeBSD’s grep does not have a “-P” flag by default FreeBSD has no “nproc” command Conclusion: It is easier to port a shell than a shell script. — Larry Wall I ran into some cases where my scriptology was lacking and suboptimal, even for my own personal use, and fixed them. ##News Roundup ###OpenBSD’s unveil() One of the key aspects of hardening the user-space side of an operating system is to provide mechanisms for restricting which parts of the filesystem hierarchy a given process can access. Linux has a number of mechanisms of varying capability and complexity for this purpose, but other kernels have taken a different approach. Over the last few months, OpenBSD has inaugurated a new system call named unveil() for this type of hardening that differs significantly from the mechanisms found in Linux. The value of restricting access to the filesystem, from a security point of view, is fairly obvious. A compromised process cannot exfiltrate data that it cannot read, and it cannot corrupt files that it cannot write. Preventing unwanted access is, of course, the purpose of the permissions bits attached to every file, but permissions fall short in an important way: just because a particular user has access to a given file does not necessarily imply that every program run by that user should also have access to that file. There is no reason why your PDF viewer should be able to read your SSH keys, for example. Relying on just the permission bits makes it easy for a compromised process to access files that have nothing to do with that process’s actual job. In a Linux system, there are many ways of trying to restrict that access; that is one of the purposes behind the Linux security module (LSM) architecture, for example. The SELinux LSM uses a complex matrix of labels and roles to make access-control decisions. The AppArmor LSM, instead, uses a relatively simple table of permissible pathnames associated with each application; that approach was highly controversial when AppArmor was first merged, and is still looked down upon by some security developers. Mount namespaces can be used to create a special view of the filesystem hierarchy for a set of processes, rendering much of that hierarchy invisible and, thus, inaccessible. The seccomp mechanism can be used to make decisions on attempts by a process to access files, but that approach is complex and error-prone. Yet another approach can be seen in the Qubes OS distribution, which runs applications in virtual machines to strictly control what they can access. Compared to many of the options found in Linux, unveil() is an exercise in simplicity. This system call, introduced in July, has this prototype: int unveil(const char *path, const char *permissions); A process that has never called unveil() has full access to the filesystem hierarchy, modulo the usual file permissions and any restrictions that may have been applied by calling pledge(). Calling unveil() for the first time will “drop a veil” across the entire filesystem, rendering the whole thing invisible to the process, with one exception: the file or directory hierarchy starting at path will be accessible with the given permissions. The permissions string can contain any of “r” for read access, “w” for write, “x” for execute, and “c” for the ability to create or remove the path. Subsequent calls to unveil() will make other parts of the filesystem hierarchy accessible; the unveil() system call itself still has access to the entire hierarchy, so there is no problem with unveiling distinct subtrees that are, until the call is made, invisible to the process. If one unveil() call applies to a subtree of a hierarchy unveiled by another call, the permissions associated with the more specific call apply. Calling unveil() with both arguments as null will block any further calls, setting the current view of the filesystem in stone. Calls to unveil() can also be blocked using pledge(). Either way, once the view of the filesystem has been set up appropriately, it is possible to lock it so that the process cannot expand its access in the future should it be taken over and turn hostile. unveil() thus looks a bit like AppArmor, in that it is a path-based mechanism for restricting access to files. In either case, one must first study the program in question to gain a solid understanding of which files it needs to access before closing things down, or the program is likely to break. One significant difference (beyond the other sorts of behavior that AppArmor can control) is that AppArmor’s permissions are stored in an external policy file, while unveil() calls are made by the application itself. That approach keeps the access rules tightly tied to the application and easy for the developers to modify, but it also makes it harder for system administrators to change them without having to rebuild the application from source. One can certainly aim a number of criticisms at unveil() — all of the complaints that have been leveled at path-based access control and more. But the simplicity of unveil() brings a certain kind of utility, as can be seen in the large number of OpenBSD applications that are being modified to use it. OpenBSD is gaining a base level of protection against unintended program behavior; while it is arguably possible to protect a Linux system to a much greater extent, the complexity of the mechanisms involved keeps that from happening in a lot of real-world deployments. There is a certain kind of virtue to simplicity in security mechanisms. ###NetBSD Virtual Machine Monitor (NVVM) NetBSD Virtual Machine Monitor The NVMM driver provides hardware-accelerated virtualization support on NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is provided in libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary. Download The source code of NVMM, plus the associated tools, can be downloaded here. Technical details NVMM can support up to 128 virtual machines, each having a maximum of 256 VCPUs and 4GB of RAM. Each virtual machine is granted access to most of the CPU registers: the GPRs (obviously), the Segment Registers, the Control Registers, the Debug Registers, the FPU (x87 and SSE), and several MSRs. Events can be injected in the virtual machines, to emulate device interrupts. A delay mechanism is used, and allows VMM software to schedule the interrupt right when the VCPU can receive it. NMIs can be injected as well, and use a similar mechanism. The host must always be x8664, but the guest has no constraint on the mode, so it can be x8632, PAE, real mode, and so on. The TSC of each VCPU is always re-based on the host CPU it is executing on, and is therefore guaranteed to increase regardless of the host CPU. However, it may not increase monotonically, because it is not possible to fully hide the host effects on the guest during #VMEXITs. When there are more VCPUs than the host TLB can deal with, NVMM uses a shared ASID, and flushes the shared-ASID VCPUs on each VM switch. The different intercepts are configured in such a way that they cover everything that needs to be emulated. In particular, the LAPIC can be emulated by VMM software, by intercepting reads/writes to the LAPIC page in memory, and monitoring changes to CR8 in the exit state. ###What ‘dependency’ means in Unix init systems is underspecified (utoronto.ca) I was reading Davin McCall’s On the vagaries of init systems (via) when I ran across the following, about the relationship between various daemons (services, etc): I do not see any compelling reason for having ordering relationships without actual dependency, as both Nosh and Systemd provide for. In comparison, Dinit’s dependencies also imply an ordering, which obviates the need to list a dependency twice in the service description. Well, this may be an easy one but it depends on what an init system means by ‘dependency’. Let’s consider ®syslog and the SSH daemon. I want the syslog daemon to be started before the SSH daemon is started, so that the SSH daemon can log things to it from the beginning. However, I very much do not want the SSH daemon to not be started (or to be shut down) if the syslog daemon fails to start or later fails. If syslog fails, I still want the SSH daemon to be there so that I can perhaps SSH in to the machine and fix the problem. This is generally true of almost all daemons; I want them to start after syslog, so that they can syslog things, but I almost never want them to not be running if syslog failed. (And if for some reason syslog is not configured to start, I want enabling and starting, say, SSH, to also enable and start the syslog daemon.) In general, there are three different relationships between services that I tend to encounter: a hard requirement, where service B is useless or dangerous without service A. For instance, many NFS v2 and NFS v3 daemons basically don’t function without the RPC portmapper alive and active. On any number of systems, firewall rules being in place are a hard requirement to start most network services; you would rather your network services not start at all than that they start without your defenses in place. a want, where service B wants service A to be running before B starts up, and service A should be started even if it wouldn’t otherwise be, but the failure of A still leaves B functional. Many daemons want the syslog daemon to be started before they start but will run without it, and often you want them to do so so that at least some of the system works even if there is, say, a corrupt syslog configuration file that causes the daemon to error out on start. (But some environments want to hard-fail if they can’t collect security related logging information, so they might make rsyslogd a requirement instead of a want.) an ordering, where if service A is going to be started, B wants to start after it (or before it), but B isn’t otherwise calling for A to be started. We have some of these in our systems, where we need NFS mounts done before cron starts and runs people’s @reboot jobs but neither cron nor NFS mounts exactly or explicitly want each other. (The system as a whole wants both, but that’s a different thing.) Given these different relationships and the implications for what the init system should do in different situations, talking about ‘dependency’ in it systems is kind of underspecified. What sort of dependency? What happens if one service doesn’t start or fails later? My impression is that generally people pick a want relationship as the default meaning for init system ‘dependency’. Usually this is fine; most services aren’t actively dangerous if one of their declared dependencies fails to start, and it’s generally harmless on any particular system to force a want instead of an ordering relationship because you’re going to be starting everything anyway. (In my example, you might as well say that cron on the systems in question wants NFS mounts. There is no difference in practice; we already always want to do NFS mounts and start cron.) ###Jailing The bhyve Hypervisor As FreeBSD nears the final 12.0-RELEASE release engineering cycles, I’d like to take a moment to document a cool new feature coming in 12: jailed bhyve. You may notice that I use HardenedBSD instead of FreeBSD in this article. There is no functional difference in bhyve on HardenedBSD versus bhyve on FreeBSD. The only difference between HardenedBSD and FreeBSD is the aditional security offered by HardenedBSD. The steps I outline here work for both FreeBSD and HardenedBSD. These are the bare minimum steps, no extra work needed for either FreeBSD or HardenedBSD. A Gentle History Lesson At work in my spare time, I’m helping develop a malware lab. Due to the nature of the beast, we would like to use bhyve on HardenedBSD. Starting with HardenedBSD 12, non-Cross-DSO CFI, SafeStack, Capsicum, ASLR, and strict W^X are all applied to bhyve, making it an extremely hardened hypervisor. So, the work to support jailed bhyve is sponsored by both HardenedBSD and my employer. We’ve also jointly worked on other bhyve hardening features, like protecting the VM’s address space using guard pages (mmap(…, MAPGUARD, …)). Further work is being done in a project called “malhyve.” Only those modifications to bhyve/malhyve that make sense to upstream will be upstreamed. Initial Setup We will not go through the process of creating the jail’s filesystem. That process is documented in the FreeBSD Handbook. For UEFI guests, you will need to install the uefi-edk2-bhyve package inside the jail. I network these jails with traditional jail networking. I have tested vnet jails with this setup, and that works fine, too. However, there is no real need to hook the jail up to any network so long as bhyve can access the tap device. In some cases, the VM might not need networking, in which case you can use a network-less VM in a network-less jail. By default, access to the kernel side of bhyve is disabled within jails. We need to set allow.vmm in our jail.conf entry for the bhyve jail. We will use the following in our jail, so we will need to set up devfs(8) rules for them: A ZFS volume A null-modem device (nmdm(4)) UEFI GOP (no devfs rule, but IP assigned to the jail) A tap device Conclusion The bhyve hypervisor works great within a jail. When combined with HardenedBSD, bhyve is extremely hardened: PaX ASLR is fully applied due to compilation as a Position-Independent Executable (HardenedBSD enhancement) PaX NOEXEC is fully applied (strict W^X) (HardenedBSD enhancement) Non-Cross-DSO CFI is fully applied (HardenedBSD enhancement) Full RELRO (RELRO + BINDNOW) is fully applied (HardenedBSD enhancement) SafeStack is applied to the application (HardenedBSD enhancement) Jailed (FreeBSD feature written by HardenedBSD) Virtual memory protected with guard pages (FreeBSD feature written by HardenedBSD) Capsicum is fully applied (FreeBSD feature) Bad guys are going to have a hard time breaking out of the userland components of bhyve on HardenedBSD. :) ##Beastie Bits GhostBSD 18.10 has been released Project Trident RC3 has been released The OpenBSD Foundation receives the first Silver contribution from a single individual Monitoring pf logs gource NetBSD on the RISC-V is alive The X hole Announcing the pkgsrc-2018Q3 release (2018-10-05) NAT performance on EdgeRouter X and Lite with EdgeOS, OpenBSD, and OpenWRT UNIX (as we know it) might not have existed without Mrs. Thompson Free Pizza for your dev events Portland BSD Pizza Night: Nov 29th 7pm ##Feedback/Questions Dennis - Core developers leaving illumOS? Ben - Jumping from snapshot to snapshot Ias - Question about ZFS snapshots Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv

Cassie Dan and James fill us in on public concerns surrounding the online data storing of census information and apples claim that Australian banks may be causing a security problem for iphones.Laura summers shares more interviews from the 2016 Web Directions conference with Stephanie Rewis, Lead Developer on Design Systems at Salesforce UX and Dmitry Baranovskiy, a Sydney-based web developer, interested in HTML, CSS, JavaScript, XSLT and SVG.

Рады представить наш нулевой выпуск, в котором наш специальный гость, Макс, делится потрясающим опытом - ему удалось поработать в реальных проектах с такими CMS как SharePoint 2010, Umbraco, SiteCore and EpiServer, о которых и будет идти речь. Также Restuta поддержит беседу рассказав об опыте общения с не такой крутой, но молоденькой и подающей надежды Orchard.Интересное в выпуске:любовь, бизнес и CMSкак между собой разработчики называют SharePointминутки троллинга о роли XSLT в CMSкак выбрать CMS и от чего это зависитгде приятнее деплойментМатериалы, обещанные в выпуске:EPiServer sdk - http://sdk.episerver.com/Tech Notes - http://world.episerver.com/Documentation/Categories/Products/EPiServer-CMS/Free extensions - https://www.coderesort.com/p/epicode/wiki/WikiStartBlog of creator of pagetype builder - http://joelabrahamsson.com/EPiServer Developer resources systematized: http://www.frederikvig.com/2010/05/episerver-developer-resources/#toc-globalization-localizationFriendly community - http://our.umbraco.org/video tutorials - http://wiht.link/umbraco-resourcesblogs: http://www.nibble.be/, http://www.blogfodder.co.uk/P.S. Спасибо DJ Tapolsky за предоставленный трек.P.P.S. Да мы знаем, про металлический шум и уже дали Рестуте по шее, чтобы говорил громче.

Guest: Charles Fulnecky | Drink: Mojito | Topic: History of XSLT and AJAX, AngularJS vs. ReactJS. Where the web is headed. How the web is modularizing. How to best utilize the available web technologies and be a contributing member of the community.

Materials Available here:https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Fernando-Arnaboldi-Abusing-XSLT-for-Practical-Attacks-UPDATED.pdf Whitepaper Here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Fernando-Arnaboldi-Abusing-XSLT-for-Practical-Attacks-WP-UPDATED.pdf Abusing XSLT for Practical Attacks Fernando Arnaboldi Senior Security Consultant at IOActive White paper available here: https://media.defcon.org/DEF CON 23/DEF CON 23 presentations/Fernando Arnaboldi - UPDATED/DEFCON-23-Fernando-Arnaboldi-Abusing-XSLT-for-Practical-Attacks-WP-UPDATED.pdf Over the years, XML has been a rich target for attackers due to flaws in its design as well as implementations. It is a tempting target because it is used by other programming languages to interconnect applications and is supported by web browsers. In this talk, I will demonstrate how to use XSLT to produce documents that are vulnerable to new exploits. XSLT can be leveraged to affect the integrity of arithmetic operations, lead to code logic failure, or cause random values to use the same initialization vector. Error disclosure has always provided valuable information, but thanks to XSLT, it is possible to partially read system files that could disclose service or system's passwords. Finally, XSLT can be used to compromise end-user confidentiality by abusing the same-origin policy concept present in web browsers. This presentation includes proof-of-concept attacks demonstrating XSLT’s potential to affect production systems, along with recommendations for safe development. Fernando Arnaboldi is a senior security researcher and consultant at IOActive, Inc. He has over 10 years of experience in the security research space (Deloitte, Core Security Technologies and IOActive) and holds a Bachelor's degree in Computer Science.

Transformación de documentos XML con XSLT. Introducción a las Arquitecturas Cliente/Servidor. Asignatura: Diseño de Sistemas de Información WEB. Grado en Estadística Empresarial. Profesor: Alejandro Bia Platas. Dpto. de Estadística, Matemáticas e Informática. Área de Lenguajes y Sistemas Informáticos. Proyecto PLE. Universidad Miguel Hernández de Elche. Explica los aspectos generales, teóricos y prácticos, de la transformación de documentos XML usando XSLT.

Introducción a la programación XSLT. Introducción a las Arquitecturas Cliente/Servidor. Asignatura: Diseño de Sistemas de Información WEB. Grado en Estadística Empresarial. Profesor: Alejandro Bia Platas. Dpto. de Estadística, Matemáticas e Informática. Área de Lenguajes y Sistemas Informáticos. Proyecto PLE. Universidad Miguel Hernández de Elche. Introducción, mediante ejemplos y ejercicios, a la programación de scripts XSLT.

Illegal Argument Episode 86 - Pixel Shuffling Java 7 0day Java 7u7 More security holes in 7u7 How to hack weak passwords Developer Quits OAuth 2.0 Spec, Calls It ‘a Bad Protocol SAML and XSLT - scarily it exists JavaScript User Interfaces are worse, or no better than old Windows UIs No Software Patents in New Zealand Related Google+ Threads Combining Functional and Imperative Programming for Multicore Software WebStorm 5.0 - Live Editing with Google Chrome

Episode 4 of Radio Liferay is out. I'm speaking with Raymond Augé, Sr. Software Architect at Liferay podcast-logo We spoke about these topics - and probably more: * Internet coverage in Northern Ontario * Forums, IRC, Blog * The beauty of XML and XSLT (in 2004) * Bits of Liferay's history since 2004, e.g. the Sourceforge Mailinglist * Some Features Ray has been involved in: WCMS, Permissions, Document Repositories, Asset API, Service Builder, Staging, Search - basically most of what's somehow related to WCM. * The enjoyment of sharing information. Not disseminating information is counterproductive. (At this place I'd like to place a completely unrelated shoutout to JT - you know what for ;-) ) * the benefits of keeping hands away from UI code. * (Learning english in this episode consists of my "inadvertently" stumbling across my tongue) * Feature talk: The new staging in 6.1, "site variations", how work on it was done. * The use of the different templating languages: Velocity, Freemarker, XSLT * WebContent and Templates can partly replace portlet & plugin development. Documented on Ray's Blogpost Advanced Web Content Example with Ajax and Liferay Live presentation * OSGi, in Ray's Blog and on github Find Ray and me on twitter You'll find this episode - and make sure that you don't miss any of the future episodes - by subscribing to http://feeds.feedburner.com/RadioLiferay. You can also subscribe on itunes.: Just search for "Radio Liferay" or just "Liferay" in the podcast directory.

This Week on developerWorks is dedicated entirely to quick summaries of new content highlights for the week and new site features. developerWorks newsletters editor, John Swanson, joins podcast host Scott Laningham.

OCLC Senior Research Scientist Ralph LeVan dives deeper beneath the surface to describe the open source technologies he uses to expose records in text databases as Linked Data. He also talks about Java, Servlet Filters, XSLT, and SRU, plus explains how anyone can use his framework to make their database content available as Linked Data.

Die Vorlesung führt in die wichtigsten Konzepte von Webdokumenten anhand des Standards XML ein.

Die Vorlesung führt in die wichtigsten Konzepte von Webdokumenten anhand des Standards XML ein.

MP3 format

PDF format

QuickTime format

QuickTime format

PDF format

PDF format

MP3 format

PDF format

Flat Word Strategies: New Technologies Create Interactive Learning   Introduction In "The World is Flat," Thomas Friedman makes the case that a number of forces have converged to flatten and restructure the global competitive landscape, and that this process is continuing and accelerating.  This flattening has empowered individuals to compete and collaborate on a global scale like never before.  As educators, we must understand the implications for us, our students and our institutions and more globally on education and learning.  Key flatteners that are already impacting education include the Internet, open source software, search, wireless/mobility, VoIP, digitalization, personalization and virtualization. One of the key observations of this less predictable, less hierarchical flattened world is that knowledge is widely distributed and rapidly changing leaving traditional course-based learning increasingly unable to meet the needs of students.  Bridging this divide requires new paradigms in education that incorporate "flat' world strategies such as informal learner-driven knowledge transfer and new technologies and forms of learning. Question from Mike: Gordon, can you give us a little background on some of the new tools being used? In the 1990's many of us first started to use the Internet to deliver and supplement content for our courses. We developed relatively static web pages that included text and pictures in similar format to traditional textbooks. Today with the combination of high bandwidth access and new development tools, fresh web content looks and feels much different. With "Web 2.0" tools and delivery methods, instructors are discovering new ways to develop and deliver content to and engage their students. Among the new tools finding their way into business and into the hands of our students are: Search,Instant Messaging, Blogging/Podcasting,Wikis,RSS/Subscription, andWireless/Mobility. While many faculty are well-versed at using websites, email, and course management systems to interact and engage with their students, most have been slow to adopt some of these "new" technologies into and outside of their classroom. These new tools are part of the dynamic, interactive new Internet many are calling Web 2.0. According to techtarget.com, the term Web 2.0 was first used by O'Reilly Media and MediaLive International in 2004 during a next generation web conference. Web 2.0 based technological advances have continued over the last two years and new applications are coming out daily that allow faculty and their students to experience new ways of interacting and learning. Much of this new technology is built around two fundamental technologies, AJAX and RSS. Question from Gordon: AJAX â�� thatâ��s soap, right Mike? Jesse James Garrett of Adaptive Path (www.adaptivepath.com) is responsible for coining the acronym AJAX in a February 2005 article. In the article, Garrett describes AJAX or Asynchronous JavaScript and XML, as a new approach to web applications. In terms of user interaction, what makes AJAX stand out is that it allows developers to create web applications that start to approach the richness and responsiveness of desktop applications. AJAX is not a technology, nor is it code or an application that can be downloaded. Instead, it is a collection of technologies that have all matured and when combined together provide for a new paradigm for the architecture of web applications.  More precisely, AJAX includes XHTML and CSS; DOM or the Document Object Model; XML and XSLT; XMLHttpRequest; and JavaScript.   Technologies Role XHTML + CSS Standards-based presentation Document Object Model (DOM) Dynamic display and interaction XML + XSLT data exchange and manipulation XMLHttpRequest Asynchronous data retrieval JavaScript Binds everything together   To understand how AJAX works, we first have to understand the classic or traditional client-server web application model.  In this model, user actions (typically through a web browser interface) trigger an HTTP request back to the web server, which processes the request (retrieving data, performing calculations, etc) and responds to the client (user) with an HTML page.  While this model has been extremely successful at building out the Internet, it breaks down when developers try to replicate the user experience of desktop applications.  Thatâ��s where AJAX comes in.  AJAX represents a fundamental shift in what's possible on the Web.  To provide this functionality, we introduce an AJAX engine as an intermediary into the traditional client-server model. Simply put, instead of loading a web page at the start of the session, the browser loads the AJAX engine on the client side of the relationship.  This engine is JavaScript code that coexists with the browser, usually in a hidden frame, and is responsible for rendering the web interface and communicating with the web server on the user's behalf.  Practically speaking, what this does is ensures that the user is never looking at an empty browser window waiting for the server to respond and the page to refresh.  With first generation web technology, user actions would generate an HTTP request; with AJAX these requests are JavaScript calls to the AJAX engine.  Many user actions don't require communication with the server and can be handled by the engine.  If the server is needed, the engine makes the request asynchronously using XML, with no interruption of the user-application interaction. Question from Mike: Gordon could you tell us a little bit about RSS? RSS (RDF Site Summary and also referred to as Really Simple Syndication) is a technology used to push content out to subscribers using an aggregator application like My.Yahoo or Google Reader. In addition web browsers like FireFox and Internet Explorer 7.0, along with Mac OS X and Microsoft's upcoming Vista operating system, have built in aggregator functionality. These applications allow the user to subscribe to different feeds and have content pushed out to the aggregator. Here's an example of how you can use this technology â�� if you have a free Yahoo account, you can configure your account to aggregate, or collect, different types of content. Once setup, you can go to any computer with a browser and an Internet connection, go to My.Yahoo.com, log in with your username and password and have your custom page come up with all of your subscribed feeds listed. Your feeds are selected by you and you can add and remove as you see fit. Here are some the feeds we like and subscribe to: Gizmodo for breaking gadget news, Broadband Reports for news on delivery technology and Information Week for breaking IT news. Let's look at how it works â�� let's say Information Week publishes an article on a IT workforce needs â�� if you are logged in to your aggregator and subscribed to the Information Week feed, you see the title, a brief summary of the article and how long ago it was published (minutes, hours, days, weeks, etc) on your aggregator page. If the article looks interesting you can click the link and then read the entire article. This technology has allowed many to cut back considerably on hard copy technology journal reading and email subscriptions â�� most common journals and periodicals are now publishing content with RSS feeds, allowing readers to subscribe and rapidly scan and review content. RSS developers create an XML file that describes content as it is posted on websites. The blog at nctt.org/blog is a good example if you want to take a look at an XML file. The blog is written using a word processor and then the content is typically copied and pasted into a blog editor with the XML file automatically updated with the latest content. If you are a subscriber to nctt.org/blog your aggregator checks the NCTT blog site periodically for updates and, if it finds one, it lists the content on the aggregator screen. You can see a brief summary on the aggregator and, if you wish to read further, you can click the link and read the entire blog. Your current students are using this technology on, in some cases, a minute by minute basis. Let's take a look at how it can be used. Let's say you wake up one morning not feeling well and have to cancel your classes. When and how do your students find out you are out sick? Maybe you send out an email which requires students check their campus email account or (worst case) you call in and a note goes on the door or board. In both cases many, if not all, of your students will show up for class and be disappointed to find out you will not be there. Using a simple RSS feed, you could give your students the option of subscribing and actually push the message out to their cell phone or other connected device. Students get the message and do not end up showing up for a class that has been cancelled. Question from Gordon: Mike, What are some of the popular apps out there now that people are using? The â��killer appâ�� or application that demonstrated the potential and viability of AJAX is Googleâ��s gmail service. The use of AJAX has since exploded. Examples include the aggregators we mentioned earlier, which all leverage AJAX technology to provide for a more pleasing user experience, as well as a whole class of â��webwareâ�� â�� web-based applications that attempt to replicate desktop applications, including Writely, ZohoWriter, ZohoShow, Google Spreadsheets, and DabbleDB. With these applications, you and your students have access to a virtual office suite, allowing students to interact and collaborate online. This new class of tools and technologies provide faculty with an opportunity to engage their students inside and outside of the classroom. Question: Gordon: Where can people find the content of this article? You can find the content of this podcast in the Oct/Nov 2006 edition of Community College Journal, at nctt.org/blog and at nctt.org/podcast.  In addition you will find a maintained list of several interesting links that further demonstrate these technologies. You can reach the authors at gsnyder@stcc.edu and mqaissaunee@brookdale.edu and at their National Science Foundation center and project websites at www.nctt.org and www.maitt.org    

Web services are changing the fundamental nature of the web, as more and more companies offer their data for free. Rather than spending millions of dollars on complicated systems, entrepreneurs can tap into the existing services of companies like Amazon, and create innovative new enterprises for a fraction of the cost; enterprises that wouldn't have been economical otherwise. In this session, Amazon Web Services Evangelist, Jeff Barr, discusses the power of open APIs and how they are helping to fuel innovation and entrepreneurship. Jeff discusses Amazon's motivation for building AWS and some of the design decisions (such as their use of XSLT) they made along the way. Jeff touches on some of Amazon's current offerings such as S3 and the Mechanical Turk, before showing demonstrations of how these services are being used in the wild.