Picture Me Coding

A week ago a developer in San Francisco named Andres Freund found a backdoor in SSH which would grant some shadowy figure access to Linux machines running the latest version of a library called liblzma.  Even more incredibly, there were various semi-anonymous figures clamoring for inclusion of this compromised version of liblzma into the latest version of various Linux distros. 

This entire scheme had been underway for over three years before it fell apart under Freund's scrutiny and attention from the broader software industry.

This week Mike gives us a breakdown of the exploit and we talk about the fallout from this backdoor which took advantage of an overworked and vulnerable open-source maintainer. 

As Mike puts it, the story is "bonkers".

To read more about it, check out these articles: 

• The Verge: “How one volunteer stopped a backdoor from exposing Linux systems worldwide” 
• Wired: “The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind” 
• TuxCare: “A Deep Dive on the xz Compromise” 
• Timeline from Boehs.org: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

Send us Fan Mail

Along with our friend Bob Farzin, we visit upon the sleeping body of AI three ghosts this week: one for the past, one for the present, and one for the future. We make a sincere attempt to haunt the crap out of LLMs like GPT, Claude, and Github Copilot and to give them a truly spooky, creeped out feeling as they look upon what they're doing to their industry.

What skills will we need in the future if AI writes all of our code for us? What's going to happen to our tools, our programming languages, our industry? Will we have to go to more meetings?

Erik is a lot more nervous about the future than the calmly reflective Mike and Bob, but we'll do our best this week to predict the future.

Send us Fan Mail

In our industry there are myriad examples of companies behaving unethically, so what power do we have as software engineers to uphold ethical principles and resist bad behavior? In this episode Mike and Erik look at adopting a software engineering code of ethics, relying primarily on the ACM's Code of Ethics as a foundational set of guidelines for ethical and professional behavior.

Also, we're not really known for this but it's worth mentioning that this episode may include some hot takes? I guess I would say that these takes are at least a little warmer than usual.

Mike's music choice this week is The Past is Still Alive by Hurray For The Riff Raff, while Erik talked about his travails with DNS. 

Oh, by the way, if you want to email us, the email address is working now(!) and we can be reached over at [email protected]

Send us Fan Mail

Mike's out this week so Erik went into his backyard and talked about famous Naturalists while birds chirped in the background. It's short and unexpected! 

Send us Fan Mail

It’s a very old software engineering question: should we build the thing or buy the thing? Fred Brooks says "you should always buy." This may even be an existential question: my role is to build things, not to buy them, right? Why would I ever buy anything? 

According to Mike, learning to answer the "Build or Buy" is an essential part of becoming a software engineer, so we'll try to answer it for you definitively this week!

Erik has been listening to Ovlov's Buds while Mike has been listening to Strings Attached: The Voice of Kannel by Anna-Liisa Eller.

Send us Fan Mail

In which Mike and Erik try to understand what "edge computing" means and whether it's meaningful or marketing speak. The topic comes up because Mike decides to run an LLM on his laptop and it turns out that when he's doing this he's participating in edge computing!

For musict his week Erik is listening to the Baroness album Stone while Mike has been into Brittany Howard's What Now.

Send us Fan Mail

This week Mike and Erik dig into their bookshelves to find and discuss their favorite technical books. As per usual, Mike references a bunch of stuff Erik has never heard of but one new thing this week is that Erik tries hard not to piss off Radiohead fans.

Books Mentioned

• Unix Network Programming, W. Richard Stevens
• Software Architecture in Practice, Bass, Clements, Kazman
• Fundamentals of Interactive Computer Graphics, Foley and Van Dam
• The C Programming Language by Brian Kernighan and Dennis Ritchie
• Hacker’s Delight by Henry Warren
• Joe Celko's Trees and Hierarchies in SQL for Smarties
• A Practical Guide to Linux Commands, Editors, and Shell Programming
• Mastering Regular Expressions
• Javascript: The Good Parts by Douglas Crockford
• Natural Language Processing with Python
• An Introduction to Functional Programming Through Lambda Calculus by Greg Michaelson
• Kubernetes Up and Running by Kelsey Hightower, Brendan Burns, and Joe Beda
• Building Microservices by Sam Newman
• Enterprise Integration Patterns by Gregor Hohpe and Bobby Woolf
• Designing Data-Intensive Applications by Martin Kleppmann
• The SRE Book by Betsy Beyer, Chris Jones, Jennifer Petoff and Niall Richard Murphy
• Mazes for Programmers by Jamis Buck
• Building an Interpreter in Go, by Thorsten Ball

For music this week Erik's into The Smile's Wall of Eyes,  while Mike likes Compassion by Vijay Iyer, Linda May Hah Oh, Tyshawn Sorey

Send us Fan Mail

This week Mike and Erik conclude their discussion on complexity with a review of the 2006 fan-favorite paper "Out of the Tar Pit."

Send us Fan Mail

As programmers, we want to control complexity and simplify our software, but these things are often hard for us to define. We know them when we see them!

This week, Mike and Erik talk about what it means to say that software is "complex" and along the way they'll offer three definitions of complexity, so the next time you're at work and commenting on pull requests and telling someone that what they've written is too complex, you can cite these random guys on this podcast!

For music this week Mike has been listening to ORQUÍDEAS by Kali Uchis while Erik is listening to SUSS, a work of ambient country music (whatever that means).

Send us Fan Mail

This week Mike and Erik chat about deploying software and try to understand how it used to be and characterize what it's mostly like now. What are the best ways to deploy we've seen in our careers and what mistakes can we avoid. As is typical, there is much complaining also.

For music this week Mike mentioned Melusine by Cecile Mclorin Salvant,
where are we?  by Joshua Redman and Gabrielle Cavassa, and Continuing by Tyshawn Sorey. Erik continued on his journey into the peaceful-feelings music forest with Alberta Cross's Sinking Ships.

Links

- Google Paper "Towards Modern Development of Cloud Applications"

Send us Fan Mail