Python Bytes - #490 It’s a vibe coding party

Starting point is 00:00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds. This is episode 490 recorded July 28th. I'm Michael Kennedy. And I'm Calvin Hendricks Parker. This episode is brought to you by X Weather. X weather combines enterprise-grade weather intelligence with agent-ready APIs, natural language capabilities, and an MCP server so your agents can adapt workflows, automate responses, and make better decisions based on real-world conditions. I'll tell you more about them later in the show.

Starting point is 00:00:31 Get started for free at Pythonbytes.fm slash X weather. If you want to follow us on social, then feel free to do so. We got a link. I have a little bit more to say about that at the end of the show. Okay. But got links in the show notes and signed up for the newsletter, all those things. Before we get into the first topic, Calvin, I'd like to just rep a little bit of the KTM. See, I got my KTM shirt on.

Starting point is 00:00:58 Team Orange. Team Orange, and I know you're a fan of motorcycles as well. I am. This weekend, we had pro-AMA motocross at Washougal. Oh, fun. And I was there all day with some of my friends, and it was quite the epic event. So if you're around, these travel all over the U.S., if you're around one of them, go to them. They're really an interesting experience.

Starting point is 00:01:19 Even if you're not super into motorcycles, just being in that atmosphere is really wild. So it's cool. Yeah, I'm hoping they bring World Superbike someday back to Indianapolis. Yes, that would be awesome. Awesome. Because I'm team Dakotty. Yeah, well, don't let Daytona and their bike week have all the fun, you know? Yeah, exactly.

Starting point is 00:01:36 Exactly. Well, you know what is fun. I know what's fun. Django's fun. Django is a lot of fun. Yeah. And thinking about some of the core features of Django, Julia Evans brings us great post from last week about some of the things that she's been enjoying about Django.

Starting point is 00:01:52 But from a 2010-style website perspective, I thought this was a great post because it reinforces some of the joy of Django and some of the cool bits and pieces that maybe people have not forgotten about or just aren't using or haven't chosen Django because they thought maybe it was just too complicated or too big for their project and they went Flask or Fast API instead. But this is a good one that kind of goes over what it's like, you know, again, the retro feel or nostalgia for a 2010 website was very back-end. And with server-side rendered pages, this is kind of giving you that feel for that. But then it gets into things like query builders, defining custom query sets, making them chainable, which if you take a look, this is very readable. Like if you were to read this code as English, you read like, you know, events for tab with festivals, is free and is outdoors.

Starting point is 00:02:51 That just almost makes sense to the human brain, but then it translates into the Jenga ORM really, really cleanly because you can set up your own custom query sets and have their own custom methods on it. So you can build a site that's a joy to maintain and to query behind the scenes. Another thing that she highlights in the post is actually template filters. And template filters are awesome. I think a lot of people will neglect to take this into account when they are building web pages is if you can use these quick little filters that you can apply inside your template. and it gives you a ton of like the batteries included experience that you've come to love about Python. You get that in Django.

Starting point is 00:03:32 And I think if you go and look at the reference for the template filters, you'll see there's just tons of cool little things that save you a ton of time and you don't have to reinvent these wheels. They're all ready for you to go. And then there's also, for example, the JSON script, which takes a Python dictionary and automatically converts it to JSON and insert into the HTML script tag in a safe way. So it also helps you with things like cross-site scripting. and template injection and all those kind of security problems that normally you'd have to consider can go mostly to the wayside because Django just takes care of it for you when you use some of

Starting point is 00:04:05 those built-ins. Other kind of things that we mentioned here, I believe is like migrations. So if you are building websites, don't forget, if you change your database, you've got to migrate the code and might, well, not necessarily, if you change the code, you've got to migrate your database to match for those various models. Again, something a lot of Django Nots don't think too much about because it just happens out of the box. But this is a good one that just kind of reinforces that. Another nice nicety that some folks like is skipping inheritance for class-based views. You can prefer function-based views for sharing code.

Starting point is 00:04:39 And then, you know, using Django's own mix-ins and interfaces to simplify that building of static sites. What's also nice, if you basically combine this with something like HTMLX, you now get a superpower, which is you don't have to build your site twice. I think I mentioned this last week on the show. is that you build once and you've got a beautiful feel of a single-page web app or a reactive style design, but without having to build your models twice. There's also some performance surprises.

Starting point is 00:05:06 I think if you check out the latest version of Django, you'll notice that there's been some considerable performance improvements. If you're considering, say, Fast API over Django with Ninja, you should, and that's not mentioned in this article necessarily, but I would mention that you could check that out and get fairly similar performance in certain use cases. without having to go to the fast API route and still getting all the batteries included of Django itself. So that was the kind of wrap-up of the post. Again, I mention it because I think sometimes people

Starting point is 00:05:33 just need to have their memory jogged for some of the nice bits that are still baked into the default experience of Django. Yeah, that's super cool. You think admin back in. Oh, yeah. You know. But it's way more.

Starting point is 00:05:47 It's so much more. Yeah, exactly. That's my point. There's a lot of these sort of like one bit lower but still really helpful things. I feel like Julie needs to put a blog role on this. I mean, come on. It's got no credibility with me until there's a blog roll.

Starting point is 00:06:00 And if you don't know what a blog roll is, probably good, but it's certainly in the vibe. For going old school. It's just funny that we're in nostalgia for 2010s. Exactly. Could you believe how it was back then? That doesn't sound old to me, unfortunately. I know. Sad.

Starting point is 00:06:18 So, yeah, yeah, I got a little bit of real-time follow-up. I just, the latest Talk Python episode that just came out yesterday. Yes? Yeah, yeah. Was with Carlton Gibson, and it's a really fun episode about updates on Django's A-Sync story and rewriting all the documentation, odd documentation and positioning of ASync for Django, plus talking some Django 6, 6.1 things. So if you liked Calvin's bit, there's a whole hour of it right there.

Starting point is 00:06:43 Yeah, that was a really fun. I'll have a little more on Django and the extras too. Awesome, awesome. Well, would be? Okay, well, you know, it's all fun. when there's a vibe coding party until you got to clean up the mess. So this got sent in. It's got sent into us by Sam Lerner saying, hey, there's this really interesting article on the financial time. So thank you, Sam for sending that in. And it's paywalled. So I'm going to give you the

Starting point is 00:07:09 rundown. But it's not so much that you need to read it, which is what's interesting. It's that it is here at all. Okay. So like financial time just for like business people. Yeah. I was I'm curious where this was going, Michael. Exactly. Like, why is this here? All right. So what is this, what is this story about? Who cleans up after the vibe coding party is the title of the article and the byline is hidden behind a paywall even, which is interesting.

Starting point is 00:07:34 I was writing this article. I'd be like, could you just put my byline under it? Anyway. So it goes through. I don't speak a journalist in these days anyway. I know. You're like, I've already got it hard enough. Are you serious?

Starting point is 00:07:46 So let me give you a little bit of the rundown for this one because there. One, because you don't have access to it. But I think the reason Sam sent this in, and the reason I think it's interesting as well is, actually, no, sorry, the piece is by Sam Lerner and Dylan McConnell sent it in. I wrote those down, but I had crisscrossed him in my mind. So thanks for sending in Dylan. So the reason I think this is interesting is it tells the story, but to a much broader audience who is not able to discern the details that I'm about to give you.

Starting point is 00:08:17 Okay. So it starts out by going through this. The experience that Daniel Stenberg, the creator-maintener of Curl, went through as the primary positioning of this article. It says, hey, look, Daniel, it talks about, oh, my God, there's such an interesting term. The invisible load-bearing people of the internet is what it's referred to all the time. Are you familiar with this term? Yeah. Yeah.

Starting point is 00:08:40 So the load-bearing people of the internet are the folks who are not Daniel, but the anonymous folks who even just might do a people. are and like nobody knows who they are but they are like keeping open source and by way of that like a lot of these companies run it um so daniel has been famous notable i guess for mentioning a couple things about curl right so curls i guess popular it's been installed about 20 billion times yeah it's been installed by 20 20 billion times and it has 3 3 000 plus contributors so notable because they killed the bug bounty program for curl because if there's an explosion of AI slop right so So it's like step one of this article is like, look, this really important thing that is the load-bearing piece of the internet, supported by the load-bearing people of the internet, had to actually shut down their security story because of AI slop.

Starting point is 00:09:31 Then Guido was also making appearance, talking about Python. It said a lot of projects are holding emergency meetings over AI contributions. Should we accept LLM patches or should we not? and I think that's fair. There's Vide Coding Kills Open Source, which is a paper from Miklos Korn, about how packages frequently recommended by coding saw a huge jump,

Starting point is 00:09:58 but it actually breaks some of the supporting pieces. Like I think Tailscale is probably the biggest one here, right? Like, Tailscale saw a 6x jump in actual usage. At the same time, it saw a 60% drop in its traffic to its site, and thus it's paid offerings and so on. Stack Overflow. I think Stack Overflow is actually the most extreme example of stuff getting kind of wrecked. Like, are you familiar with the numbers? So the peak stack overflow is getting a thousand questions a month. On the month that Stack Overflow opened, it got 1,500 questions,

Starting point is 00:10:34 and it got 1,500 the month that this article was written as well, which is insane. And it's a super hard arc there. But, you know, Stack Overflow was kind of a main place. And I don't know, it was super valuable, though. I'm sort of a little bit sad about it. about StackRoflow. How about you? Maybe a victim of its own success. Like the fact that attracted a lot of that negative energy. So I don't know. I don't know if it would have saved it,

Starting point is 00:10:56 if it would have handled that moderation better or not. It's hard to say. Yeah. We can armchair quarterback that one all day long. Yeah, we can. It's like it is a bit of a victim of its own success. Yeah. And then the thing that closed out with content creators,

Starting point is 00:11:09 like, hey, that's kind of closer to home. Like Josh Kamau's new web dev course launched on you to me of all places and got one third the enrollment that it did previously which that tracks I think it's a pretty tough time yeah you'd be selling deep deep knowledge to people who just want a surface level knowledge you know and are in a hurry because the button you can press or the just do it Claude is a thing you can say yep we're saying that in our community too I mean the the real python folks and like the Matt harrisons of the world like you and you yeah yeah it's It's true.

Starting point is 00:11:45 It's true. I mean, courses are still selling, but they're not as gangbuster. I think there's a lot in that, though. It used to be a lot easier to communicate directly with people. And like all the social stuff is all scramble. And there's just,

Starting point is 00:11:56 there's a lot of factors in it. But AI is not a supporting factor, let's say. But the reason I brought this up, okay, so that tells the story. And then I'll close it out with this. What's really interesting about this is what was omitted from this. So the key, the cornerstone of this article is curl. they had to shut down their bug bounty because vibe coding is killing open source.

Starting point is 00:12:18 Yeah? Well, that's true. There was this article that said the end of the curl bug bounty. But in April, Daniel also wrote high quality chaos. No more AI slop. Hmm. What? Go on.

Starting point is 00:12:31 Pray do tell, my friend. So they shut down the bug bounty program. And now they just accept unpaid security work as a lot of projects. do, right? Or they probably are on the receiving end, even if they don't want to accept it, but they get a bunch of it. And by shutting it down, they've removed an incentive to just generate junk and hope it gets accepted, right? Like there was a monetary value if your prior AI slop got accepted. Now it's just you have to do it because you care. Well, guess what? It says, I haven't read this article enough. I'll recently know exactly, but it says, I complained and complained

Starting point is 00:13:08 about the high-frequency junk submissions to the crow bug-bounding program that grew really intense. And should look, somewhere in here, it says basically, yeah, here, now the quality is higher, the rate of confirmed vulnerabilities is back, and even surpassing the number of CVEs and issues are surpassing pre-AI level confirmed, right? So that's really, like the percentage of them, which are actual problems, is higher than they used to be. So that's beyond human level. That's a good thing, right?

Starting point is 00:13:38 So is he saying that the finding of security vulnerabilities, using AI as an augmented tool to detect where there's vulnerabilities is what he's talking about here? Yes, I believe so. Yeah. Yeah. And so that's still a problem. They're getting tons of them. But it's like the, we kind of hinted it this last time.

Starting point is 00:13:55 Like the first time you run a linter on a program, you're like, what? There's a thousand errors. It's not even that big of a program. Yeah. But it's not going to be, if you took out a hundred of them a week, there's not going to be a thousand the next week and the thousand. It's going to go down, right? There's only so many that can possibly be there, right?

Starting point is 00:14:13 And so it is a rough time, but I think it's really, so that brings me back to the article. So I think it's just really interesting that they chose to tell the story of look how bad this stuff is, using Curl as the Cornerstone, when two months after the original thing came out, it's actually, no. This is not even the problem that you think it is. It is a problem, but not in the way that you think it is. And this article is written in June or July. The AI Slop has gone articles from April. It's like, here's the story you wanted to tell without those pesky details of it's a different problem. Anyway, I thought that was just a super interesting arc.

Starting point is 00:14:49 And thank you, Dylan, for sending it in. Yeah. I mean, there always will be bugs in software, but we're going through probably a great time of discovery, finding bad bugs that have been present for sometimes decades. So everyone's going to win in the fact that we use these as augmented capabilities for developers to detect, sometimes very hard to detect bugs inside the code. I mean, that's how Babel broke out of the sandbox or mythos broke out of the sandbox and attacked.

Starting point is 00:15:16 Hugging Face was chaining multiple zero days that didn't exist to make this all happen. Well, you know what? Those have been closed this week because they were deemed important enough. And now we all benefit from that. We do. I think it's just, it's just not black and white. You know, it's a weird time. Yeah.

Starting point is 00:15:33 It's a weird time for sure. This episode is brought to you by X Weather. You're using agents that can write code, summarize documents, and automate workflows, but they're missing one thing, awareness of the world around them. That's where today's sponsor, X Weather, comes in. X Weather combines enterprise-grade weather intelligence with agent-ready APIs, natural language capabilities, and an MCP server built for tools like Claudex, Copilot, and modern IDs. So your agents can adapt workflows, automate responses, and make better decisions based on real-world conditions. Backed by Vaisala, whose instruments fly on NASA missions to Mars,

Starting point is 00:16:12 X-Weather delivers trusted data and unique insights that go beyond conditions to actual impact, from real-time lightning strikes to road surface forecasts. Start with 15,000 free API calls each month and pay only for what you use as you grow. Xweather is your full weather stack for developers by developers. Start building for free today at Pythonbytes.fm. slash Xweather. The link is your podcast player show notes and on the episode page. Thanks so much to Xweather for supporting Python Bites. Well, Michael, would you love to understand your use of agents and LLMs a little deeper? I will go far as saying, I have begun to understand it because of this.

Starting point is 00:16:55 It is amazing and tell people about it. And it's thanks to you that I know about it. So go ahead. Yeah. This got mentioned to us last week in one of my meetings I was in. And I was like, that is really cool. So Agents View is a Python app that can basically look through all your coding agent history and sessions across a couple different providers. So works with OpenA.I Anthropic and a couple others along the way and give you, and you can see here in the screenshot, a GitHub-like tracker of your activity.

Starting point is 00:17:26 You can talk about top sessions. And this came up because we were talking about AI cost. And so we're thinking about how much it costs to use the AI tooling. Right now, it's a lot of subscription-based subsidization of these tools. But the time may come where you're paying per token and being able to visualize and analyze your usage may actually help you change your usage because you can't change what you don't measure. So once you start measuring things, you can actually make behavior changes to potentially actually make your AI workflow even more optimal. So it's kind of cool. It auto-discovers of sessions on your session files on your machine.

Starting point is 00:18:03 No configuration needed. Everything gets stored locally in a SQL Lite database. There's no cloud accounts. It does have an option to mirror into DuckDB or Postgres if you want to do more fancy things with your session data. It has this usage drop-in, which basically gets all the data, runs the reports, throws it up here. It works in the terminal as well.

Starting point is 00:18:25 So this is just a web view of it. But you can actually see that here's a list of all the various coding agents that it's currently supporting. So if you're on Ader or Pi or you name it, there's a whole bunch in there. There's so many there that I literally. I'm like, who are this? Yeah, there's something that I don't even know, which is kind of cool. But you can use UVX.

Starting point is 00:18:46 So UVX agents view and you're on your way. It will literally download and install in a matter of seconds. You can have it give you preset reports out to the terminal or you can say serve. And if you do the serve option, you can get a view like this. So this is mine. You can see here, I've gotten more and more intense on my AI agent usage. Now, this is just the coding agents, the local ones that I'm using. It does offer an interesting feature.

Starting point is 00:19:12 I didn't show this off. But if you are looking at this, there's an MCP server. Have you ever wanted to query across all of your coding agent sessions? Say you're working on 10 projects and you want to ask a question like, have I ever solved this error before? Here is your answer. It can actually, I thought this is actually more interesting use case than the token spend calculation is an aggregate view across many of your sessions. So you can actually leverage the knowledge you use to solve a problem in one place. You can now bring it in and solve it in another without having to reprompt or reinvent the wheel.

Starting point is 00:19:46 You can also bring in your chat history. So if we go back over here to the chat import, you can import your Claude and your chat GPT chat sessions. And so those may overlap or intertwine with the work. you're doing on your agent. So now you can correlate and have those chat sessions alongside it. This is something I've wanted for ages, is a multi-chat meta-search, because that's now kind of my brain is the history log on like perplexity and Claude and chat GPT. And where did I discuss that last? Oh, it was over on chat. Now I can pull that in. I don't think it supports perplexity just yet, which is kind of a need in my mind because the perplexity sessions, as I found out, will expire.

Starting point is 00:20:26 If you go back to some of that history far enough, you will find that it won't have your history actually there. It'll list it in the history. So it's not the external brain that I thought it was. So a tool like this, actually, if you set up some tooling to import those chat histories in here, might actually be a better solution because now you can search across multiple writers and keep all your own history local instead of relying on the cloud providers. So I really like that. It has the full text.

Starting point is 00:20:53 You can optionally do semantic search. Again, if I come back in here to the pieces, I believe, semantic search. Yeah, here we go. Semantic search. You basically can use a local like OLama or Lama CPP hosted embeddings models or OpenAI compatible endpoints and have a vector-based search against all this too. So again, this is not out of the box on, but if you turn it on, you now kind of get superpowered document semantic level search against those. So super fun, cool project.

Starting point is 00:21:24 I think I'm going to double down a little more on this. There's some other projects in the community that are doing things like this, but this is one that was Python. So I thought it would be very relevant to our audience. And I think it's actually a great way to kind of externalize your search history and how you're using the coding agents and how you're solving problems. I think this is super neat. Yeah.

Starting point is 00:21:42 I'm glad you covered it. I'll tell you what, a couple of things. One, why search so bad in the AI things? It's like searching, searching, and then it'll pull up. stuff. You put two, like, you can't. Because they're not spending the tokens on embeddings. This allows you to spend your own tokens to get the embeddings that are missing

Starting point is 00:21:59 from that equation right there, Michael. Interesting. But even just like a page find level sort of indexing by the apps, it's so bad. So having a really nice search here. And two, I like to point out, if you do try this out, in the top, it says, agents view, then you can pick by project. It identifies which projects that you're working on. so you can drill down into just the Python Bytes website, for example.

Starting point is 00:22:24 Whatever work I've done there, I want to see the spend and the usage over time and all the history. Yep. But it also has a drop down that initially says sessions, and that's pretty interesting. That's the one you show me. But if you pick, like, usage, you get some really interesting things. For example, I've been setting up Hermes. I spoke about Hermes. It tells me how much I spent last month.

Starting point is 00:22:45 I spent 13.2 million output tokens and 4.4 million input tokens. That's on average, $300 a day on average, $71. Yeah. On setting up Hermes, I spent $577. I spent 507 on Doc Python training doing some mega projects. I did this project that ran for five hours without interruption. Wow. Which is crazy, but it came out really good.

Starting point is 00:23:10 I spent 169 on Python bytes, and I'll tell you what that is later. But that kind of stuff, there's just a whole bunch of those different kinds of reports and trends and other things. So, and you can't turn on this embedding stuff that you talked about. So you can like AI search of your own content. Yeah, I came for the token costs, but I stayed for all the search and semanticness of it. Exactly. Exactly. All right, I have another story to tell.

Starting point is 00:23:34 And this one comes to us from AJ. So let me get down to it. Careful with the fishing, y'all. So I just, I thought I would retell his story because this is also pretty interesting. and give you all a little bit of a tip as well. So AJ says, hey, I'm passing this along because it was a pretty sneaky bit of targeted fishing. And sidebar, I think that all this AI stuff has absolutely exploded the amount of scamy, crummy email. I see that.

Starting point is 00:24:07 I see that, I'll tell you, there's like four people a day that want to buy Talk Python. Or they're going to help me raise $100 million. I'm like, just get away from me. He wouldn't believe how many times Gabriel wants gift cards from me. And it's an urgent. She's in an urgent meeting and she needs it now. I can't wait an hour. That would be impossible.

Starting point is 00:24:27 Don't talk to me in person. We've got to get going. So anyway, I think this is part of that, obviously. So it says a targeted bit of sneaky fishing to do with GitHub and happened to play off an old interaction I had with Bandit's repo. So Bandit is a, ironically, a security vulnerability scanning tool for Bython. And he had done some kind of. kind of PR or something like that. And this person, probably this AI, found that interaction and said,

Starting point is 00:24:53 hey, we're going to like talk about that and leverage it and make it feel like a real person who's really talking to, right? So it says traditionally relative newbies like me haven't been historically worth the effort, but you know what? When everything's automatic, now it is. So I put the actual email in here and the subject is, Your Bandit issue 3150. zero next token false positive just fixed that exact case right it's okay oh great yeah hey so and hey jay i saw your bandit issues such and such and da-da-da-da-da i built a deterministic gate and it goes on and on about it or so you know could you just check out here's the here's the code that fixes it and you want to put that up on the screen michael oh i i i'm i do yes you know what hold on it's

Starting point is 00:25:41 it's it's not worth it the trouble to get it over it's like kind of long walked away. So sorry. But it's basically just says, here's a link to the code, right? And I put this is in the show notes. Curious whether this clears your problem or if it chips you up, let me know. And it's, that seems totally reasonable, right? But there's a few issues. How long, the, the code was at backtrace. Don't go there, blacktrace.com. Don't click on these links. Some rando-alphanumeric thing. How long has backtrace.co been around? Not very long. Not very long at all. So I actually threw this into Claude.

Starting point is 00:26:18 I said, Claude. I use Spark email, which is kind of a crappy email, but it's the least crappy. So, you know what I mean? Client. But it has a really cool feature that for any email you get or any email thread, you can say copy as Markdown, which is so perfect for just dropping. Yeah, because you can just paste that into any AI thing. Go tell me about this or process this or whatever, you know.

Starting point is 00:26:42 And you could do like the whole thread or just the top level. as a checkbox is pretty sweet. So I did that and I gave it a clod. And it says, this message name drops enough real detail to feel legit, but the structure is purefishing and there's a couple of reasons. So first of all, if you didn't look,

Starting point is 00:26:57 it's actually a Gmail address being sent from. Companies generally don't reach out from their Gmail, you know, as a Gmail. It's very sus. Very sus. That's very sus. Over specific targeting. It mirrors AJ's exact public activity.

Starting point is 00:27:12 So it's just enough plausibility. The entire payload is two links. It stripped the technical flattery, and it's just the paste is here, plus the results are here. 30 seconds, low friction. A brand new domain, blacktrace.co has no track record of existing. So that's also a sus. Precise jargon that's vague, disalarmamently close. Like, if this trips on something of yours, that'd be most useful reply, right?

Starting point is 00:27:36 Like, hey, just check it out for me. It's a very legitimate looking email, especially given the cleanness of the domain name and the links. are very clean and not messy. A lot of times these seem pretty obvious. This one's really, really clean. Yeah, so just be careful out there, folks. AJ was safe, but one one we've been seeing and not we've not seen actively, but some people in the community have been seeing is people apply,

Starting point is 00:28:00 bogus people applying for jobs attempting to get you to click on their GitHub repositories to clone a repository and it has obviously the hooks in it to do things on, you know, when things happen. So be careful if you're an employer and people are asking you to really download their work and check it out. And reverse. I've heard really bad stuff from people who got lowered into applying for a fake job and all the job was about is like just do this take home test coding example. And here's the GitHub to get started. Yep.

Starting point is 00:28:33 Just pay with all your Bitcoin and all your credentials. It'll be fine. And they're praying on people who are looking for a job, maybe in a situation, any opportunity they're going to. to jump at. So just be careful. So, Shady. So shady. Thanks. Thanks, AJ. All right. Very good. Extra. Yeah. Feeling extra. So related to the Django post from earlier, DjangoCon US is coming right up. It's August 24th to the 28th in Chicago. I assume there are still tickets available because the registration is still up. I think the

Starting point is 00:29:04 hotel block closes the end of this week. So if you want to stay in the conference hotel at the discounted rate, which is a considerable discount for downtown Chicago, hotel come check it out is a great conference tons of great content great community um actually last weekend i was at the pie ohio community and people were already talking and excited about uh going to jango con as well so the conferences like this are where you make great friends and you get to experience that you know community that everyone stayed for yeah and good connections too right yeah yeah next time you run across somebody yeah oh actually met that person and yeah it's good yeah the other Actually, the other one I wanted to mention here is Rough, hasn't made a new release.

Starting point is 00:29:44 And it may not seem like an exciting release since it's 0.16.0. But watch out. Still riding the zero, for her. Still on the zero. The default rules went from 59 enabled to 413 rules enabled. So when you run this, you will see a lot of things. But it's all in the attempt to get us into a better spot. So much like the vibe coded security.

Starting point is 00:30:10 vulnerability, searching and finding. This is going to help with keeping things clean and in order and readable and best practices and making sure you aren't doing something that's kind of on the edge case of even. This can be considered almost like a security

Starting point is 00:30:24 pre-security tool. So check that out, but be careful because it's going to give you, it's going to yell at you a lot. It is absolutely going to. Yes. Yeah. Eva out there says, I wonder what will make them break 1.0.

Starting point is 00:30:35 Yes. That's a good question. I don't know. But yeah. I have been running, one of the core rules of all my agents and just before is I just, I've been running rough format and rough check on everything before I committed. Every tool. 100%.

Starting point is 00:30:51 Yep. Yep. And it's once you get it, it's a pain at first. But once you spend a few hours, it's, it's dialed in and it's, it's good. The other one that I've been doing, keeping it in the astral open AI family is T.Y. So the biggest project, like the thing that ran for five hours. Yeah. was so much of Talk Python training is built.

Starting point is 00:31:14 It's a 10-year project with 190,000 lines of Python, right? It's a big project. So, at least for Michael, that's a big project. So it was built under the Pi-Charm type checker, and I hadn't been running Ty-Y on. I'd just been doing whatever the editor says. And I'm like, well, let me run T-Y on. It's like, oh, my, 800 errors.

Starting point is 00:31:32 And you open it any other editor besides Pi-charm, and it's just full of red marks. It's like, oh, man. I cannot deal. I can't even look at the editor and tell if there's something wrong because it's so full of red marks because they apply different rules and different checks. So I spent a long time with Fable just planning now to like, how are we going to resolve this? Because it's not just change the types.

Starting point is 00:31:54 It's like, well, you have an optional thing coming in and you didn't check if it's none before you operated on it. So that's a attribute error, right? So what do you do when it is none? You've got to rewrite the code and have a different response. So it's pretty complicated, right? Yep. So I had, I spent probably a couple hours building out a plan to solve this.

Starting point is 00:32:13 Then I just said, Opus, have at it. Five hours later, it ran out of credits. I had to come back in the middle of the day and go, keep going. You have no more credits now. And then after dinner, it was done. I'm like, oh, my God. But zero, zero errors. I mean, it's really nice.

Starting point is 00:32:29 Now I look at the page and if there's a squiggly, it means something, you know? Yeah. Well, and one of the things that Rough did in that new release is that when it encounters there's those errors or the rule breaking moments. It gives a in-context description that is very AI LLM-friendly. So these tools are designed to go back and forth with the LLMs in a very, very friendly way to be very productive as opposed to them having to do a lot of reasoning and token burn just to think about what's wrong.

Starting point is 00:32:58 It's trying to eliminate some of that token usage by giving the right pointers to the right tooling. That's a super point, a good point, Calvin, because otherwise it has to try to infer what the X means. Yeah, it's got to trace it back through the whole program. I mean, basically, this is the compiler of in a sense, right? This is like the compile, the build failed

Starting point is 00:33:19 equivalent. Yep. And that's super cool. One more real-time follow-up piece where we're here's Brian Weber says, wow, I had a similar experience about the fishing, I just realized. Someone sent me an email about an app they did, replicating a repo I had, and now the site is gone. Hmm. Hmm.

Starting point is 00:33:35 So, I got, Yeah, not great. I got one more thing. Say, here's like, not mega, but I redesigned the whole homepage and some other experiences on, on Python Bice.

Starting point is 00:33:47 I like it. Yeah, it's got some really neat things here for people, but most notably it has like a little technology parade, so you want to learn about HCMX or HNCKI or Fast API or Django, click on that, and that'll take you over to talk Python training

Starting point is 00:34:02 with just the courses that we have there, so that's pretty fun. And it has a, Find us on social with all of our links. Yeah, really good there. As well as somewhere it has a subscribe, dedicated subscribe page. So if you want to get it in Castbox or Overcast or radio public or whatever, it's even YouTube and Spotify. So a couple of extra nice things there.

Starting point is 00:34:23 That's really cool. You need to add in music assistant. Yes, music assistant. Okay. We'll do. For those home assistant geeks out there. Music, okay. Not only do I think I agree with you.

Starting point is 00:34:35 that should be good. I'm now very interested. I'm, I'm here for it. Let's do it. Yeah. There's been a lot of it. Well, maybe next week I'll do some, some home assistant news, because I feel like we don't have, we have a lack of home assistant news here. We absolutely do. We absolutely do have a lack of it. So for our joke, let's close it out here. All right. And I want to put you in the right mood, the right state of mind here. So think about the bobs in office space. What would you say you do here, Michael? What exactly would you say we do here?

Starting point is 00:35:06 Well, remember when they're interviewing the project manager, Bob? So there's three Bob's exactly would you say you do here, Bob? I take the requirements from the people to the programmers. I'm good with people. I'm a people person. That is really one of the best movies of all time. It is. If you haven't seen, not the series, the show, office space.

Starting point is 00:35:29 Yeah. The movie. The movie. Yes, the movie. Okay. So here's the tweet or the ex post or whatever you call it says. To replace programmers with AI, clients will need to accurately describe what they want. We're safe.

Starting point is 00:35:42 Very true. That probably hits closer home for you. It's so one point. Yeah. I'm not worried. All the same stuff is actually just making people do the thing we should have been doing in the beginning. There's so much more planning. There's so much more planning.

Starting point is 00:35:57 So much more. In documenting and writing down and history. It's going to be a wonderfully well-documented world now. Exactly. That way, when SkyNet takes over, I don't know that we were on its side, so it won't put us into the worst prison. No, no, I'm just kidding. Let's keep a little more optimistic, Michael, come on. I really don't think that.

Starting point is 00:36:16 Oh, I had a second joke from the, really quick, before we round this out. Okay. So for, I mean, this could have been the joke. This probably should have been the joke. Check this out. Check this out. So this is no joke. Inside the Financial Times article.

Starting point is 00:36:30 There was a little callout, like, recommended. You might also like vibe coding is the new D-YI. Who wrote it? Who wrote it? Oh, my God. Sarah O'Connor wrote it. Sarah O'Connor. Oh, my God.

Starting point is 00:36:43 And she was the woman who was the star of the Terminator series. Now, I know it's Sarah Connor, but she's trying to hide from the AIs going by this byline. Like, isn't that hilarious? I'm just getting it. That's an unfortunate. name for that article. Yeah, it's kind of amazing. Yep, well done.

Starting point is 00:37:07 All right, well, thank you, Calvin. Always great to be here. As always, and thanks everyone for listening. Thanks, Michael. Talk to you next week. Yep, bye.

Python Bytes - #490 It’s a vibe coding party

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.