Sharp Tech is, for the first time, available on video. You have two ways to consume it: YouTube, and here on Stratechery
Maybe you still struggle to write in Pulaar, or in your rinky-dink language. But here in the AI-connected, English-speaking world, we don't need to write anymore. In fact, I don't remember the last time I wrote English. I have one master agent that I talk to and tell what I need to get done. It breaks down the tasks and serves them to spawned agents that get the work done. I spend $3,000 a month on tokens. I use them mostly for: My great transition this year, as a programmer, was that once I accepted that AI can merge code without needing my review, I could let go. What this meant was that when AI writes English for me, I no longer need to review it before publishing. It can write English, and it writes it well. Okay, let me add this here before I go too far: . I read this blog post yesterday, and I'm always baffled to hear technical people write these words : Writing code is solved. As a software engineer who uses AI, I feel like I must be holding it wrong. I've found a correlation between the number of lines of code written and the number of bugs found. Whether a person or a model generates the code, the longer the PR, the higher the odds of finding an issue. So when someone says coding is solved, I automatically assume they were mediocre at best before using these tools. If we look at it technically, we could say, in the same vein, that writing English is solved. The AI can write correct sentences, write paragraphs, or publish an entire document. If you have doubts about the content, you can have a second AI verify it and fix potential hallucinations. But of course, that's not how it works in the real world. The moment people detect AI-generated text, even if it is after reading the whole text, they reject it. It feels empty, deceitful. What is an anecdote from an LLM to convey, when the experience never actually happened? Yes, code is not to be consumed like English. It is for the machine. But it is subjective in its purpose because we humans have to read it eventually. Writing code is not solved, just as writing English cannot be solved. Writing is subjective and has no solution because it isn't a problem. If anything, AI for writing is a testament to this saying: "Je n'ai fait celle-ci plus longue que parce que je n'ai pas eu le loisir de la faire plus courte." — Blaise Pascal Research and search Summarization and transcription Writing (the big one) Art and music
…is an essay I wrote in 2020 about font fallback and all these mysterious “missing character” characters like �. = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/when-fonts-fall/1.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/when-fonts-fall/1.1600w.avif" type="image/avif"> If you are curious, too, you might find it interesting! It was fun researching this, and I ended up going in unexpected directions, including emoji and “Unicode fonts.” The essay pairs nicely with text.makeup , as that’s the tool that can help you investigate a suspicious string to see what exactly happened. (The writing is on Figma’s blog, but it doesn’t talk about Figma-specific typography – as a matter of fact, it’s deliberately kept universal, with Figma behaviour only mentioned in one sentence.)
Databases are for storing global variables. We usually call them “rows” or “records” instead, but they’re definitionally global variables: any part of your program can read or write them. Isn’t this kind of weird? It’s common programming advice that global variables are bad, and yet many elegant programs rely on databases. Either the common advice is wrong, or there’s something special about databases that makes them the exception to the rule. What’s so bad about global variables? Here’s the two main 1 reasons, in my view: Both of these apply to databases. Any part of your program that makes a query can send and receive data from any other part of your program. In practice this happens all the time: one function will save some data on a record, and another one will check for it. And if you haven’t seen bugs where some piece of code makes some incorrect expectation about the shape 2 of a database column, you haven’t been working on web systems for long enough. So why aren’t database-backed apps in terrible architectural shape? In the rest of this post I’ll consider some options. First, we could bite the bullet : maybe all database-backed apps really are a mess . This is surprisingly plausible. When I think about the systems I’ve worked on that haven’t involved a database, they’re usually much cleaner and more elegant. If managing state is the hardest thing about designing software — and I think it is — then systems that manage less state are going to be better-designed. However, this doesn’t explain everything. Database-backed apps aren’t that bad, and even in database-backed apps, we try to avoid introducing regular global variables 3 , so in practice we treat global variables as worse. Second, we could say that databases offer ACID guarantees that mitigate the damage of global variables . Unlike regular global variables, databases offer a consistent view of state and the ability to atomically change multiple pieces of state together. I don’t really buy this. The problem with global variables is not just that they can get out of sync, it’s that they exist at all. If you think this is the difference, you are committed to thinking 4 that if you stick a mutex around a global variable then it suddenly becomes acceptable. Third, we could say that databases are more explicit . Mutating or reading a global variable looks like ordinary code, but database queries need some connection object to be passed in and some query function to be invoked. When you’re scanning through code, you can see where the database queries are at a glance 5 . Not so for global variables. This does actually kind of mitigate the implicit-coupling problem. Maybe regular global variables would be better if you had to set and get them with long, involved function calls. Fourth, we could say that databases are less flexible . A global variable could store anything : a function, a class, an image, and so on. A database just stores data . I can buy this explanation for untyped languages. Global Ruby variables that could be reassigned from a string to a hash table are far more terrifying than a “global” database column that could change from one string to another string. But since the advice to avoid global variables applies to typed languages as well, I don’t think this could be the reason why databases are better. Fifth, we could say that we know how to use databases . For instance, whenever I read from a database, I reflexively check the type of the column so that my code doesn’t make assumptions that aren’t guaranteed by the database. There are use-cases that I would never even consider using a database for (e.g. to track a counter in a loop, or to store the name of the file where my config is stored). In other words, we have norms and customs 6 around using databases that minimize a lot of the damage that global variables can cause. There’s nothing inherent about databases that make them better, it’s just how we use them in practice. Overall I think the third and fifth reasons are most convincing: databases are better because they’re more explicit and because we only tend to use them for a limited set of purposes. It’s interesting to note that these reasons are contingent , not inherent. A codebase which had conventions around global variable use 7 could also fulfil these conditions. Would this make global variables fine, or at least no worse than a database? I think so. I don’t recommend you go out and start putting global variables in your programs. It’s more interesting to note the meta-point here: that two pieces of common software engineering dogma — avoid global variables and use a database for state — are partially inconsistent. Most software design knowledge is still just a pile of loose heuristics. I don’t really know how to build software and you don’t either . As I’ve written about before , we should therefore all be very suspicious of engineers who appeal to “best practice” without being able to give concrete reasons, even in cases as obvious as “global variables are bad”. For instance, concerns about readability and tracing follow from the first reason. I don’t really buy reasons like “it’s not thread-safe” or “global variables might shadow local variables”: any architectural problem that can be trivially solved with a mutex or a linter is not a real problem. For instance, that a string supports 4-byte UTF-8, or that a column can/can’t be NULL. You could say we avoid introducing global variables because databases are essential and global variables are not. In theory you could replace any global variable by threading a local variable through, but you do need a database if you’ve got gigabytes of structured data to manage. However, that doesn’t explain why database-backed apps still tend to be better-designed than apps with many global variables. I’m not saying this is necessarily wrong. The argument would go something like “well, if you implement a simple in-memory database for your global variables, that is better!” This is only sort of true. If you’re designing a system, you’d be well-advised to make it as true as you can. While I love Rails, my main beef with ActiveRecord is that it makes queries invisible. To be fair, some of these are guaranteed by the fact that the database exists over the network. Plus types, probably, and concurrency controls if we’re not in a single-threaded language. They allow any part of your program to implicitly send data to any other part instead of passing it around via function signatures They couple different parts of your program: if one part depends on a variable having some value, any other part can break it For instance, concerns about readability and tracing follow from the first reason. I don’t really buy reasons like “it’s not thread-safe” or “global variables might shadow local variables”: any architectural problem that can be trivially solved with a mutex or a linter is not a real problem. ↩ For instance, that a string supports 4-byte UTF-8, or that a column can/can’t be NULL. ↩ You could say we avoid introducing global variables because databases are essential and global variables are not. In theory you could replace any global variable by threading a local variable through, but you do need a database if you’ve got gigabytes of structured data to manage. However, that doesn’t explain why database-backed apps still tend to be better-designed than apps with many global variables. ↩ I’m not saying this is necessarily wrong. The argument would go something like “well, if you implement a simple in-memory database for your global variables, that is better!” ↩ This is only sort of true. If you’re designing a system, you’d be well-advised to make it as true as you can. While I love Rails, my main beef with ActiveRecord is that it makes queries invisible. ↩ To be fair, some of these are guaranteed by the fact that the database exists over the network. ↩ Plus types, probably, and concurrency controls if we’re not in a single-threaded language. ↩
I've seen the picture of the iPhone Duo, still in the store, perched on a stand, its screen flickering with broken white lines. Apple has touted testing the screen hinge, opening it mechanically thousands of times. The phone survived every test it was put through. Yet here it is, on the stand, with a broken screen. Wait till the product meets its first customer. I'm sure the tests worked in theory and in the delicate hands of its engineers. But customers' hands are anything but delicate. Remember Elon Musk's wrecking ball? They must have tested the Cybertruck's window beforehand, but it took just one person outside the test group to break the glass with a single throw. I remember when my nephew was barely a year old, not even able to walk. I handed him a wooden spoon in the living room as a distraction while I ran to the kitchen to get some food. As soon as I got there, I heard a snap. I came back to find this little boy holding the spoon, broken in two. It was a hard spoon, and there was no way his one-year-old hands could break it in half, yet there was the proof in front of me. So yes, Apple tested the rigidity of the screen with fancy machines, but the iPhone Duo never stood a chance against the customer's hands. Unless we are holding it wrong?
Debuggers are an incredibly powerful and useful tool, but they mostly show you only the present and let you move forward. 1 Inspecting the present can help you understand the past, but is that a limitation we must accept? What if you could travel back in time to see what happened? What if you could see the exact moment a value was written, and who wrote it? What if you could run your debugger backwards ? Rewind is a deterministic virtual machine that records a program’s execution once, and then lets you replay it identically, many times. This lets you run the debugger backwards, and see the history of a value in memory, including who last read and wrote it. Turns out that you can go backwards by fast-forwarding. Going backwards changes how you debug: you can see how a value got there, not just what it is now. In who wrote this byte? found the program that wrote a byte of a file. That was the easy case. Every write to a file goes through the kernel, and Rewind’s kernel logs each one. Writes to memory don’t go through the kernel, so there is no log to read. So instead we go backwards, by running forwards again . This is how can tell us who last read and wrote a value in memory, and it is the same trick that lets gdb run backwards as well. Let’s see how it works. Aside: New to Rewind? Start with a flaky build you only catch once and dafuq is a deterministic VM? Let’s use the example from Nix wrote half of my debugger . Two tellers each deposit 10, twenty times, into one account: In our example, crucially, there is no lock around the read and write of . If the other teller runs in between, one of the deposits is lost. runs the program under different thread schedules until one fails: narrows schedule 1’s failure down to steps 3,245 and 3,246 and records that run, , which is the one we will dig into. We expected 400 and got 310. Nine deposits are gone. 😬 Our program prints the balance at step 3,291. We can run at that step and the variable 2 to see who last wrote it: Rewind goes “backwards” through the run, looking for the last write to that value. We can see that the last write was at step 3,282, by teller 2 (thread 141) on line 41. But wait, 300 + 10 is 310. That write is fine! 🤔 The last write is rarely the bug. The money went missing earlier, when a teller wrote a value it had read much earlier. We need to augment with the reads too, to see that. lists every read and write of the value, back to the start of the process. Here are the rows around where it goes wrong: Reading the chronology, we can see that teller 2 read the balance at step 3,248, and then teller 1 made nine deposits, taking the balance from 110 to 200. Then at step 3,263 teller 2 wrote its stale value of 120, overwriting the balance and losing the nine deposits (90). 💣 In this example, the bug is obvious, but in a real program it can be hard to find. The option shows you the whole history of a value, and you can often see where it went wrong without ever setting a breakpoint. You can even see the bug in the plot of the balance over time: The example is simple and the fix is obvious: a lock around the read and write. In a real program, the bug can be subtle and the fix complex. Seeing the history of a value, and who last wrote it, can be invaluable in tracking down the root cause. The Rewind app gives the same information but in a more interactive way. The source panel underlines every value that can watch: You can click on the value to see who wrote it, and then click Show reads too to see the whole history of that value. Show reads too draws every access, one lane per thread. Teller 2’s lone read sits in the middle of teller 1’s deposits, and that one dot is the bug. 🙌 If you would rather drive, can go backwards too by setting a watchpoint and . Here it is forked at step 3,264, just after teller 2’s stale write: You can navigate the stack, inspect variables, and step backwards with and . How does this all work? How do you run a VM backwards? You don’t. 😅 Rewind replays are completely deterministic: the same run produces the same result every time. Turns out that a simpler way to go backwards is to run forwards again, but stop one instruction sooner than last time. That is all and do. Rewind keeps a checkpoint of the machine at the start of a step. It rewinds to that checkpoint and then runs forward back to the step you want to inspect making note of every read and write along the way. If no reads or writes are found, it rewinds to the previous checkpoint and runs forward again. It keeps doing this until it finds the last read or write before the step you want to inspect. 3 keyframe keyframe step 3291: who wrote balance? 1 restore the latest keyframe before the step 2 replay forward, debug registers watching balance 3 the last trap is the answer: step 3282, teller 2, 300 → 310 teller 1 writes teller 2 writes no trap in the window? do it again from here Deterministic replay is what makes this work, and it keeps the implementation simple: going back is just going forward again from earlier. I’ve been having a lot of fun debugging my own programs this way. It’s a bit like time travel without the paradoxes. You can see the whole history of a value, and who wrote it, without setting a breakpoint and restarting the program. It’s git blame for your program’s memory. 🔍 Tools like rr and Undo record a process and let you run its replay backwards. Rewind records the whole machine, the kernel included, so the same inputs make the same run every time. ↩ The expression can be a variable, a pointer dereference, or a struct field. ↩ A step can be millions of instructions, so this can take a little bit. ↩ keyframe keyframe step 3291: who wrote balance? 1 restore the latest keyframe before the step 2 replay forward, debug registers watching balance 3 the last trap is the answer: step 3282, teller 2, 300 → 310 teller 1 writes teller 2 writes no trap in the window? do it again from here Deterministic replay is what makes this work, and it keeps the implementation simple: going back is just going forward again from earlier. I’ve been having a lot of fun debugging my own programs this way. It’s a bit like time travel without the paradoxes. You can see the whole history of a value, and who wrote it, without setting a breakpoint and restarting the program. It’s git blame for your program’s memory. 🔍 Tools like rr and Undo record a process and let you run its replay backwards. Rewind records the whole machine, the kernel included, so the same inputs make the same run every time. ↩ The expression can be a variable, a pointer dereference, or a struct field. ↩ A step can be millions of instructions, so this can take a little bit. ↩
Many organizations adopting data mesh and data products face a common challenge. They may be tasked with building a self-service platform for data products and data mesh from scratch, or they may have an existing platform that suffers from low adoption, preventing their data mesh from scaling. This article provides a platform navigator, based on the CNCF's Platform Engineering Maturity Model, to help you reason about your current situation and determine the next steps for your platform.
I reckon LLM agents can control CNC machines, and I reckon this already works today although I don't know if anyone is doing it yet. For annoying reasons I don't currently have any computer that has access to a CNC machine and the internet simultaneously so I can't immediately try this out but it would be good to experiment with. You could have a really simple AGENTS.md describing how to connect to FluidNC or whatever and parameters for the machine it's controlling, and then you could do simple CNC jobs without doing any CAD or CAM. You'd still have to load material yourself and probably set up the work coordinates appropriately using a normal gcode sender, but then you can just ask for what you want: Hi codex, I have a workpiece loaded in the plasma cutter, it is 6mm thick steel, I've setup the coordinate system already, and I want a slot for an M6 bolt to slide between centres at X0Y0 and X20Y0, go For extra style points, have codex connected up to voice control. I am almost 100% confident that codex could correctly write the gcode on the first try and successfully send it to FluidNC and run the job. (For the doubters, here's ChatGPT writing the gcode , note I haven't used a CNC plasma cutter in my life so the cutting parmeters are bogus). You may find it is reluctant to run a real machine without several rounds of confirmation, I don't know, but in any event this could probably be fixed in AGENTS.md by explaining to it that you really do want it to run your machine. For the plasma cutter example I think you'd just want AGENTS.md to tell it things like: whether to talk to FluidNC over serial or TCP or something else some examples of good values for pierce time, feed rate, and kerf width for different metals and thicknesses I think if you had an example for 4mm steel and one for 6mm steel it would probably do a perfectly adequate job of interpolating parameters to handle 5mm steel for example. You can imagine if the machine table had a referenced XY zero position like a scanner bed does then you could always load material referenced to the same point and you wouldn't have to do any coordinate setup. Especially on a plasma cutter or laser cutter where you don't have clamps in the way that need to be avoided during travel moves. For a milling machine you'd also want to either give it an automated tool changer, and information about which tool is in which slot, etc., which is not at all unusual for machines that have such capability; or else for a basic 3 axis machine you'd have to just tell it what tool you've loaded and set the Z height yourself. whether to talk to FluidNC over serial or TCP or something else some examples of good values for pierce time, feed rate, and kerf width for different metals and thicknesses
Since I wrote about it , I kept thinking about the topic of webmentions, quoting, embedding, screenshotting, and the overall idea of connecting content on the web. The more I think about it, the more I’m convinced this is two issues wrapped into one, and I suspect there’s no way to perfectly resolve the tension that exists at the core. The first issue is a technological one or how do we make sure content that is related can get connected in a way that’s convenient and can scale across million of websites? The way I see it, that’s the issue webmentions attempted to solve, by building a system that allows websites to automatically send and receive links and make sure the web is maintained. The second issue is more ideological and related to who has the right to do what in the context of other people’s content. Some people believe that since content is publicly posted, then it’s fair to be copied and distributed. Others don’t agree with that position. The line then becomes even blurrier when you start questioning what the difference is between including my post as a comment and quoting it in its entirety. The first issue is one that can probably be solved. I’m confident we can figure out a way to automatically build links and connections on the web. Doesn’t seems like an unsolvable problem to me. The second issue, however, I think that’s just unsolvable. Because that's related to the way people see the web. I think the point of personal sites is to be a node in a network. You don’t want the journey to end there. You want to help people move and go to different places, which is why I think linking is important. It’s also why I think embedding entire posts as comments is the wrong way to go. Because in doing so we’re not helping people discover new places. In his post Greg wrote: I’ve built a new blog, you’re reading it, that pulls in replies to all of my posts either micropub viewable elsewhere or simply cross-posted to other networks. I don’t really see any issue displaying them on my blog as they are public replies to my posts. To come back to the original issue with webmentions, if I had them implemented here, Greg would receive a mention. And with an automated system, my post could then appear as a reply to his post. Is this post a comment to his blog post? It obviously isn’t. I am in part replying to a point he made, but I’m also talking about other things. I think it’s reasonable for me to be able to decide if something I wrote is a reply to his post or not. What I’m trying to say here is that things are messy. Different people living in different societal contexts have different ideas for what’s considered right. And I don’t think we’ll resolve this issue anytime soon. I think treating entire posts other people write as comments is wrong. It’s their content, it’s their words, and the right thing to do is to link to their sites. But I can only speak for myself, and other people will have different ideas. Thank you for keeping RSS alive. You're awesome. Connect via email :: Sign my guestbook :: Support for 1$/month
Listen to this post: Good morning, This week’s Stratechery Interview is with Intuit CEO Sasan Goodarzi . Goodarzi took a very non-traditional path to Silicon Valley, joining Intuit in 2004 after working at Siemens and Honeywell. After managing business units across the company he became CEO in 2019, and is taking on the challenge of figuring out how one of tech’s oldest software companies manages the AI paradigm shift. In this interview we discuss Goodarzi’s background and the what it takes to be an effective generalist, and get his take on how Intuit has thrived for 44 years. We discuss the shift from Quicken to Quickbooks, the TurboTax business, and how Goodarzi thinks about the consumer space today. Then we talk about accountants, Intuit’s most important customer acquisition channel, and how the company wants to change the profession from partners to customers via AI. I present the case to Goodarzi that Intuit seems like its being disrupted, and he makes the case why they are well positioned to actual grow their market. We also touch on acquisitions like Credit Karma and Mailchimp, and how Intuit has managed business model changes in the past, and what needs to change in the future. As a reminder, all Stratechery content, including interviews, is available as a podcast; click the link at the top of this email to add Stratechery to your podcast player. On to the Interview: This interview is lightly edited for clarity. Sasan Goodarzi, welcome to Stratechery. Sasan Goodarzi: Thank you for having me, I’m a big fan of all the work that you do. It’s great to be a part of it. Well, we’ll get to my relationship with Intuit, which I’ve had for many years. Big fan? I’m going to have to think about that one. We are here to talk about Intuit, a company that you have been at, with a brief break, for over 20 years. Before we get to that, however, tell me about your background, which is a very interesting one. Let’s start with where you were born. SG: Yes, I was born in Tehran, in Iran, and I am the youngest of three — 13 years younger than the other two brothers. I was told I was special, I think I was an accident, so there you go. And back then, you’d ship your kids to the U.S. because everybody wanted to come to the U.S. to study and so my brothers were in the U.S. already studying, and my parents decided to do an experiment with me and shipped me to the U.S. at the age of nine and I was very fortunate, because the revolution actually happened. Got it. So you had already left before then, I wasn’t quite sure on that timing. SG: Yeah, yeah. I was very fortunate, I left before the revolution, about eight to nine months before the revolution, and have been in the U.S. ever since. Where did you end up in the U.S.? SG: I came to Orlando, Florida of all places, because my brothers were going to the University of Central Florida. And, by the way, back then we used to say, “U Can’t Finish”, that’s what we called it, but it’s a great university. But anyways, for that reason, I was in Orlando until my early 20s, until I started being moved by Honeywell. Every couple of years, I was going to a different state, which was a lot of fun, and eventually ended up in California. You studied electrical engineering, right? And then you were at Honeywell and Invensys. What were you doing there? I mean, it doesn’t seem quite the obvious path to being CEO of Intuit, to say the least. SG: Not at all. In fact, it’s advice I give, career advice I give to folks. I actually started at Siemens, I was a technical marketing person, which really — I don’t know why they called it marketing, it was all a technical role that supported our field sales folks. I was in the power generation business unit at Siemens so I used to go pitch why our power generation was better than anybody else’s. I don’t think they need much marketing these days in the Siemens Power Generation Unit. SG: (laughing) Yeah that’s right, they don’t. I did that for four years and frankly, I didn’t know what I wanted to do with my life, because in the meantime, I was doing startups on the side. In fact, before I even started at Siemens, I did a startup called Lazer Cables — with, at that time, a very good friend that was actually the genius behind the idea of fiber optics for the music industry, so I was dabbling in a lot of different stuff. When I was at Siemens, I love the company, but I was wondering, “Is the corporate world cut out for me?”, and I got recruited to Honeywell. And at Honeywell, they put me — it was like business development. In essence, they put me in charge of something they were experimenting with, which was just down my alley, because it was, in essence, a startup as part of Honeywell and I fell in love with the company because of that. I was there, I think like eight years. So is this — was this going to different states? Was that because Honeywell, being a defense contractor, they just have to source from everywhere? Is that the connection? SG: Yeah, but I was in the industrial home automation division. So if you look at my background, I’ve been in power generation, I’ve been in home and buildings automation, I’ve been in industrial, which means I was selling software and hardware at the time to oil companies that need to manage all of their oil and gas in the fields. I’ve been in all of those different industries and then, to your point, I got a call from Honeywell, so my whole background is enterprise and oil and gas and all those different industries. So my forte was getting into something and diagnosing quickly what was going on and what should we do about it, my expertise wasn’t in any one industry. And then, when at the time Intuit called me, I didn’t even know what the company was. Right. It’s a very non-obvious connection, so what did they see? How did they find you? SG: I think the reason they found me is, at the time, the CEO had come from GE Capital, Steve Bennett . And I think at the time, they were looking for folks that knew how to run businesses, not — these are their words, not mine — not a typical Silicon Valley grown-up leader, and that’s what attracted them to me. And I was trying to figure out what Intuit was, because, one, I had never served consumers, businesses — it was always enterprise. But I really fell in love with, at that time, the culture of the company and the leaders of the company. And when I joined, I’ve been here sort of ever since — 20-some-odd years. Well, you did leave briefly to be CEO of energy company Nexant. What advantages do you think you gained from not having at all a traditional Silicon Valley CEO background? And also, on the flip side, what challenges has that presented? SG: The biggest learning I had, which had to come innate because I was in a new job almost every three years, is curiosity — is going in and really diagnosing, really trying to get to the root cause of if something is going well, “Why?”, if it’s not going well, “Why?”. How do you assess the industry, the talent, the priorities? And so I became, only because I had to, a master of how to be curious and diagnose. Does this require a very systemic sort of thinking about the problem? What makes a good generalist? Because you, I mean, clearly you’re a generalist. So what makes that effective? SG: It is, in fact, what you just said. One, you have to be a systems thinker. You have to ask a lot of questions end-to-end, because, one, it’s not from one particular craft, and you don’t know the industry that well and so you have to ask a lot of questions. You have to understand what the customer problems are. Structurally, are you advantaged or disadvantaged? What kind of talent do you have? It requires a systems thinker. But I think the second is you learn how to hire great, great people. Why? Because you don’t know anything about the industry. Once you know what you got to go do, you need great people that know how to go do it, I think those are the advantages. The disadvantages can be that you don’t innately — like when I went from power generation business unit to serving oil and gas, they don’t have too many things in common, and so the disadvantage is intuitively, right off the bat, you wouldn’t know what to do. I think that’s the disadvantage. I would tell you, from what I have learned, I would take those disadvantages any day over a leader that’s curious, that can diagnose really, really well. Because it naturally — one of the things I love about Amazon is the Day 1 mentality. Every day is Day 1, and Day 1 truly is when you’re curious, and you’re trying to understand what’s going on, and what kind of impact can you have. Well, when you don’t know an industry, it is truly Day 1. If you know an industry very, very well, you actually have to work hard to ensure that you’re diagnosing versus, “I have the answers to everything”. I think people would generally think oil and gas, energy, tech, totally different. Is there, though, a commonality in terms of where the investment takes place and the marginal cost of serving customers over time? Is that similar, or are there still really important differences there? SG: There are a lot of similarities I have learned over time in terms of just how do you run a business. So it’s just general management is the commonality? SG: And, by the way, I actually think it applies in this environment more than ever, frankly, because structural advantages — are there any in this environment? What is your structural advantage? Making sure that you’re curious about how you really reinvent experiences because of what’s possible with AI. I think there’s a lot of commonalities, inclusive of — this is probably the biggest thing I would say when I came, and I have a lot of respect, by the way, for all the companies and all the leaders in the Valley because, frankly, we are the ecosystem that drives global innovation, period, end of story. With that said, I think one of the things I’ve learned over my career is we can end up being sloppy in the Valley in terms of how we think about expenses, how we think about cost, how we think about allocation of capital. Those are things you just — when you come from oil, gas, power generation, where margins are thin, room for error is zero because, trust me, you do one thing wrong in oil and gas, you can blow up oil tanks. And so those things carry forward in terms of how do you build quality software, where do you put your money. But then there are things that don’t carry over, which is oil and gas has nothing to do with how consumers consume stuff. Right. Can generalists — could it be a sort of weakness of generalists — you said sloppy. And I think about the generalist angle and systems thinking and it’s easy to skim over the details, “Not that important”. Is that a challenge that you sometimes think about? SG: First of all, I think every leader, no matter what industry, has to have helicopter skills. I think you have to — one, I don’t think you can set clear vision of where you need to go and then move fast to get there if you’re not grounded in details. What does that mean? I mean, for me, details are, are you meeting with customers? Are you in your KPIs? Are you using products? Are you looking around corners in terms of what has to happen in your experiences? I think you have to be detail-oriented, and not just in this environment, I think every senior leader at every level has to have detailed orientation. Systems thinking doesn’t mean you lack detail orientation, it just means that you’re thinking about a problem end-to-end and because one of the biggest things I learned at Honeywell is — think about building a plane, just as an illustrative example, end-to-end, from the moment you say, “Build the plane”, to the moment that plane is on a runway — and thinking about it wing-to-wing. So you can end up building the engine much, much faster, but if you don’t actually think about wing-to-wing — what it takes to build the plane and how to reduce the cycle time of building the plane — then you don’t ship better and faster planes in a shorter period of time. So this notion of wing-to-wing is similar to end-to-end systems thinking. You have to really figure out how to draw the box because when you redraw the box, you redraw your TAM, you redraw what’s possible and that doesn’t mean lacking detail, it just means both become very important. If AI is very good at details, is AI the biggest gift to generalists ever ? SG: I think — by the way, I was on the record, you can go back and look, eight years ago, we went in on data and AI. And the stuff that exists today, of course, did not exist eight years ago and I was on the record saying — and many laughed at me — on the record saying that, next to electricity and the Internet, it would spark the largest global innovation that we could have ever imagined. I think it’s, for many, while it has a lot of risks, it’s going to level the playing field in terms of what’s possible, what you can do, what I can do, what many can do. It’s commoditizing a lot of stuff — and not just information, but insights and helping you make decisions, what it can potentially do to healthcare, what it can do to robotics, what it can do to space. I just think it’s freaking fascinating what’s possible. Is AI a systems thinker or is it a details thinker? SG: Oh, I think, in my view, it’s all about how you design it, that’s the biggest thing we’ve learned in all the agentic work that we’re doing — is it’s only as good as the context you give it, it’s only as good as the data that you give it. The biggest mistake in learning we had in the last couple of years is we, to answer your question, we launched a bunch of AI agents , a payments AI agent, a payroll AI agent, an accounting AI agent, and while they did everything in slices very well, they didn’t actually deliver a great experience end-to-end for customers. That’s because of what the capabilities were about a year ago, but also just how we had designed it, we didn’t design it as a systems thinker. I think it can be both and of course the capabilities are just growing day by day. But it comes down to the context and how you design it, in my view. I did want to do a little bit of a historical tour. It’s interesting to talk to you about Intuit. You’ve been there for 20 years and yet only been there for half of Intuit’s history, this is one of the granddaddies of Silicon Valley. So your first product — Intuit’s, not yours personally, but Intuit’s first product — was Quicken , founded way back in 1983. The company started QuickBooks in 1992, which underpins your largest business today, of which I am a longtime customer. Was Intuit one of the first examples of productivity software companies realizing there’s a lot more money selling to businesses than selling to consumers? SG: First of all, none of us would be here but for Scott Cook , our founder, that was watching his wife, Signe, try to balance the checkbook. I’m old enough, I remember I was taught how to balance the checkbook, I remember doing it way back in the day. SG: We still have that table here, right outside of this building that I’m in, that signifies why Intuit was born. But to answer your question, it was first really the company was invented based on, there’s a better way just to manage your budget, your checkbook, and your financials, which gave birth to Quicken. But really the biggest next “aha” was that businesses were trying to use Quicken to actually manage their business and that’s really the “aha” that Scott Cook and the team had at the time, which is, “Wait a minute, rather than making Quicken better, there is this thing that we can actually invent that helps businesses, manage and be organized and manage their books”. That’s what gave birth to QuickBooks and the QuickBooks franchise, which over time became something incredibly special. Right. Your customers were misusing the product and sort of pulled the new one out of you. SG: That’s right. And Quicken, by the way, ended up only being like a $100 million business, but the brand was so much bigger than $100 million, but it really gave birth to QuickBooks. And then over time — this is a company, by the way, it’s made up of acquisitions. Many don’t know the TurboTax of today was an acquisition of Chipsoft . I have a question about that. On this point to the QuickBooks transition — well, I mean, QuickBooks Online launched in 2000. Again, very, very early to serve something online. The actual transition of your business to the cloud took a lot longer. I’m just curious — you joined, in retrospect, it was the beginning of that transition, but still four or five years after it was online. What do you remember about that transition? What was the challenge there? Was it technological? Was it consumer education? Was it internal, your business model — going from package software to a SaaS model? What was hard about that? SG: I love your question, because it actually starts with where you started, which is, this is a 40-year-old-plus company, and there aren’t too many that have survived. Because remember, we were a company that was born in the era of desktop, right? Yep, package software. SG: We were shipping CDs. No, because we use the word “package software” today, but no one realized — no, it actually used to be packaged. It was a box you went to the store to buy, with — not a CD — with discs inside of it. SG: Thank you! Yes. By the way, that’s actually why I use the words “we used to ship stuff”, we used to ship disks and CDs because many in today’s environment, when you say that, they’re not sure what you mean by “packaged.” I joined right at the beginning of that. And the challenge — I tell you, I give the company and all the leadership prior to me a lot of credit, because there aren’t too many companies that were born in the era of DOS and had to go to the cloud, to mobile, and then the transition to AI. And the hardest part is both cultural — you’ve got a bunch of talent that is building what ends up on a disk, and then you ship the disk. It’s cultural, it’s technology, all of your code is siloed, all of your code is in a bunch of different cans called disks, none of them talk to each other. Yep, and it has to be finished. There’s no updates. SG: And there’s no updates! That’s right. And so it’s cultural, it’s technological, it’s talent, and then there is the dilemma of, “Wait a minute, so you want me to, in TurboTax, build a cloud version, but we’re going to get disrupted, we’re going to disrupt our own desktop business that’s a great business and it’s highly profitable?, so then there is the Innovator’s Dilemma . SG: If you make this shift, how do you make it? So cultural, technological, talent, and then there’s the disruption of your revenue stream. Those are all massive challenges — which, by the way, that’s why we were late to the cloud, because we still have, I think, I’m going to go off of memory, several billion dollars of business that’s desktop. Now, we’re not shipping CDs and disks anymore, it’s sort of still in the cloud. But there are a lot of customers that love the desktop versions, and that’s the biggest challenge, the last one is the customer doesn’t want to change. Yep. Yeah. You mentioned TurboTax earlier, an acquisition, you’ve done a lot of acquisitions over time. I can’t remember — did you acquire TurboTax? I guess it was before you eventually sold Quicken. SG: That’s right, long before I joined. Right, eventually Quicken you sold off ages ago , TurboTax is your consumer play. To my question before — about generally it’s easier to sell productivity software to businesses than to consumers — should there be an asterisk that the way to sell to consumers is if you have the monopoly of violence on your side? Pay your taxes or else! SG: Compliance businesses are great, and that’s really what TurboTax is. That’s the ultimate compliance business. SG: It’s the ultimate compliance business, because it’s all based on the system of taxes in the U.S. and Canada, and you have to do your taxes or you pay a penalty. Now you have to keep inventing, and there’s a lot of competitors in this space, but there’s nothing like compliance businesses, they’re great businesses. Why shouldn’t the government just do the taxes for you? Especially for W-2 workers that are very basic. SG: You have to change the whole system. The government has tried. Right. Intuit has been consistently opposed to it, I think, for understandable reasons. SG: Well, we have been, because, by the way, it’s not free. When the government creates software, you’re paying for it as a taxpayer. Plus, a lot of these W-2 workers, they already have free available to them, whether it’s through us or H&R Block or many other tax prep companies. Unless we change the entire tax system, at the end of the day, free is already available to almost all Americans. By the way, including yourself — if you really want to go do your taxes for free, you could, it’s available to you today. Here’s the question about that — who is the constituency for not changing? Because you guys get cast as the bad guys, “The reason why this isn’t easy is because Intuit lobbies, blah, blah, blah”, which either one, you have the most effective lobbying operation in the history, I mean, you do lobby, I’m not going to deny that’s a fact — but at the end of the day, a lot of people complain about taxes every year and yet it’s still this way. So what are the constituencies that are standing shoulder-to-shoulder with you, as it were, in the system being as it is? SG: There’s two things we’re huge proponents of and, by the way, have been — in my 20 years in the company — when I joined, and wasn’t even running the tax business, these two things were true, and they’re still true today. One, we’re always advocating for simplifying the tax system, because the tax system is way too complicated and the more you simplify, the better it is for the consumer and the business. The other thing that we’ve advocated for is the government shouldn’t invest to build software for taxes, because it already exists and for the majority of Americans, if not all, free already exists. The government spending taxpayers’ money to create software that already exists doesn’t make any sense so those are the two big things that we have advocated for. And the reality is, every year, in some way, shape, or form, with additives of legislation, we unintentionally make the tax system a little bit more complicated. Right. That’s the constituent answer, isn’t it? Everyone is a constituency for their pet part of the tax code, and so it just never changes. SG: That’s right, that’s exactly right. From the consumer perspective, where does Credit Karma fit in this? Which, also by the way, has its own tax product. Is this just a realization, “TurboTax is a very high-margin business”, but at the end of the day, what’s the link? Are you cannibalizing yourself? To what end? SG: Let me maybe just step back and give you the strategic context very, very briefly. So I’ve run all parts of the company before I stepped into this role almost eight years ago in January. And when we declared our strategy, which was, in essence, an AI-driven expert platform with three big bets — which I can briefly get into in a moment — there was a couple of big from-tos. One, I wanted to shift the company from just being a tax and accounting platform to a company that was a platform company that helped businesses from lead to cash and helped consumers from credit building to wealth building, because I felt that, over time, one, just being tax and accounting was too small of an addressable market. And two, every business that I ran — both tax and our business group — the biggest thing I would hear from customers, our TurboTax customers would be, “Why can’t you help me grow my refund?”, “Why can’t you help me, with all the data that you have, connect me to financial products that are right for me?”, “How come you can’t give me immediate access to my refund?”, I would hear a lot of that, and nothing about, “Make your tax product better”. And when I went to the business group, all I would hear is, “I don’t really care about books and accounting, I have to do it”, and my accountant tells me, “I have to do it”, but, what about getting customers? What about managing my cash? What about helping me with whether or not I should buy inventory? So that’s the learning that I had that informed, we got to shift from just tax and accounting to an end-to-end platform company. We invested a lot in building out the platform, but I felt like there were a couple of acquisitions we needed to make and so now, to answer your question around Credit Karma — Credit Karma has like 45 million monthly active users that engage more than five times a month — taxes, once a year. So what I wanted to do is buy the platform and then integrate them to have one consumer platform where you can manage your money, do your taxes, and get access to financial products that are personalized based on your data that are right for you. That was the reason behind Credit Karma, to really create a consumer platform because the hope was, and we’re executing against that, that the more I can engage you throughout the year, the more you’re also compelled, based on everything that I know about you, to get you the biggest refund and for you to do your taxes with us and that was the reason behind the Credit Karma acquisition. Credit Karma’s ace in the hole is, it’s credit, right? People want to know what their credit score is, monitor their credit. Has that always been its biggest benefit, is customer acquisition ? SG: Yeah, that’s the biggest job that it solved, is, “What’s your credit score?”, but then really, when I bought Credit Karma, it was a data and AI platform. We have over 60,000 data points per consumer and based on all the data points, I can connect you — when you need a credit card, to a credit card that’s specifically right for you, versus just sell you a credit card. I’m agnostic, same thing with personal loans, insurance. So now it’s much more than credit score, it’s actually how we connect you to financial products that are right for you, that are personalized, how we help you with getting early access to your refund. It’s credit cards, personal loans, insurance, etc, so it’s now truly — we pretty much do everything for you, except we don’t help you trade stocks. What happens when people just start asking AI for this? Is there an aspect where you finally got to the right consumer business model — it needs to be free, you can get all these affiliate fees by connecting those different services — and then as soon as you finally get that cracked, people are like, “I’ll just ask ChatGPT”. SG: That’s right, this is where we started the conversation — where curiosity and always diagnosing matters so much, so we don’t fall in love with what we’re doing today. Let me answer your question with a perspective and a point of view about the very near future that, listen, may or may not change, but I think it’s important to start there before I answer your question. I believe that we will live in a world where, in some way, shape, or form, agents are doing a lot of the work with you and for you, with your approval and it will make life a lot easier for you. And so whether it’s booking your travel, whether it’s what is the right credit card for you, where you should do your taxes — I believe in a world where agents will do a lot of that work for you and that’s really why we have set out to build a platform where we want to be the financial intelligence layer for consumers, businesses, and accountants. What that means is I want to automate as much of the work for you, and give you intelligence, and carry out the action for you. Because if you think about what we do, we move people’s money, we help them with payroll, we help them with books, we help them with taxes and in the case of our consumer platform, it’s money, taxes, and financial products. That’s why we’ve integrated into a bunch of them — Muse , ChatGPT , Anthropic — because you can ask about, “What credit cards are right for me?”, but ultimately, when you go act on which one is the best one for me, that’s where AI agents, as we do our job right, will call on Credit Karma, will call on TurboTax, to not just give you information. But that’s a tougher spot to be, right? As opposed to most people starting with Credit Karma — where you’re actually the front door, you’re owning the customer relationship — now you’re downstream, you’ve been disintermediated. By the way, I think you’ve had executives say that channel maybe hasn’t been performing as well as you would like, is this a more aspirational goal than a reality? SG: It’s the reality we’re executing. First of all, out of the couple of acquisitions that I’ve done, Credit Karma has really worked out well. Right. I have questions about another one that is also close to me. But we can continue. SG: I am vocal about what works and what doesn’t work, so we can talk about it. But I start there because the whole essence of Credit Karma is really — we’ve executed on the platform strategy, which is create one consumer platform and really own the customer relationship and engagement. That’s the question — you build up this whole platform, and then the whole key component, the acquisition part, what happened? SG: But if you think about the brand that we have, and if you think about the capabilities that we have, we actually have better-intent customers that engage with us now through the LLMs than we did before. Right. So you get fewer customers maybe, but better customers. SG: Better quality and, by the way, not only do they still come to Credit Karma — because Credit Karma is not search-driven, it’s authenticated, it’s an app where we engage the customer. We help you with, “Hey, here’s what’s changing your credit score, here’s a card that’s right for you based on your situation”, so we’re proactively engaging the customer. And if a new customer also wants to ask, “Hey, what’s the best credit card for me”, and this is some of my information, one of the things that we’re getting LLMs to do, first and foremost, is, hey, connect to Credit Karma. Is this the new SEO? Like you need to be the service that the LLM recommends? SG: Yeah, and I think it will be even better. The reality is people now do search in LLMs versus just in Google, but I think one of the things that we’re doing is we’ve built out our experiences and continue to build out our experiences. And this is why, by the way, the OpenAI’s and the Anthropic’s come to us and we have a deep partnership — because we’re executing financial decisions, it’s not just information, it’s people’s money, it’s people’s taxes, and getting it right matters. And so for us, using the word “headless” — being within these LLMs where we get called on as the financial intelligence platform to do the work — is ultimately the way we’re building out our experiences and we think over time, it actually builds out the top of our funnel it actually expands the TAM that we have. Now, that’s yet to be proven over time, but that’s the way we built out our experiences. Presented by I spend a lot of time trying to figure out what is happening to businesses on the internet. What I often find I’m missing is a view across the economy itself. With more than 1.7% of global GDP running on Stripe, working with them means I can bring some of what they’re seeing to Stratechery. They are, in a sense, a barometer of the economy. Take the “SaaSpocalypse”. Earlier this year, nearly a trillion dollars in enterprise software value disappeared amid fears of AI eating its lunch. Stock prices only tell us what investors think will happen, and not necessarily what is happening. In this case, Stripe recently built a SaaS Index using payments data from 72,000 non-AI SaaS businesses. Looking at their actual performance, we can see that while SaaS stocks were selling off, revenue growth was actually accelerating. Year-over-year growth is now over 30%, with some of the fastest growth coming from the youngest SaaS companies. I suspect there are a lot more interesting things hiding in Stripe’s data, and I’m excited about having an excuse to go look for them. We’re going to circle back to a few of those points, but I want to get on the accountant angle. As I mentioned, I’m a longtime QuickBooks customer, the most obvious reason is that is what my accountant wanted me to use. You have a referral program, or you have had one, for accountants. How many of your customers are basically locked in via this channel? I’ve just never really considered anything else, because at the end of the day, I don’t really want to deal with it, and that’s what my accountant wants, is that just the reality for a lot of businesses? SG: By the way, I love where you started the question, because if I could — one minute on what we just rolled out at our Intuit Connect , which is a massive conference for just accountants. And then I’ll answer your question, if I may. Yep, I think it’s very interesting, I was leading to it, so please give me the pitch that you gave just a couple days ago. SG: For sure and we just rolled this out at Intuit Connect with our top accountants there. So, in essence, what we’ve been investing in is a unified financial intelligence platform that serves both sides of the network. One side of the network is accountants, the other side of the network is businesses, and the key is that it’s one unified platform. What does that mean? In shorthand, all the data, all the data models, data ingestion models, all the AI models are all one platform. But the way it shows up for an accountant suite is that the accountant suite helps the accountant manage their firm, manage their work, manage their clients, all in one place and it’s agnostic. If you have QuickBooks customers, other general ledger customers, you can plug it into Intuit Accountant Suite . That’s one side of the network. That’s a pretty significant change, isn’t it, that you’re going to support other ledgers? SG: Significant change, now we’re treating the accountant as a customer, not just as a partner, as a channel. Because in the era of AI, we — and I — had to change our approach to how we innovate for accountants. The other is the business, where not only do we serve the startups and the mid-sized businesses, which is with QuickBooks, but we now have Intuit Enterprise Suite , which is a mid-market suite that helps businesses of several hundred million in size. It’s an AI-native ERP solution that helps a mid-market construction company, wealth management company, architect company, whatever it may be, manage their business. And what we just rolled out at Intuit Connect — I’ll call out three big things. One is Intuit Intelligence , which is, in essence, think Claude or ChatGPT. You can just engage with a chat box if you wish, and you can ask it, if you’re an accountant, you can ask it, “Show me all of my customers and how they compare across profitability and margins for all of my construction businesses, and tell me which ones have their cost out of whack, and how does it compare to their peers”. That’s an example, an illustrative example of our engine doing all the work, but we’re automating the work so we can give you intelligence, which saves accountants. Right now, it’s shifting 30% of their work to advisory versus manual work, because we’re automating a lot of the work. That same capability is available to businesses, where they can just, rather than doing the work across the workflows, automate creating invoices, automate invoice reminders to get paid so a lot of our work around Intuit Intelligence has been around automation and for providing intelligence and insights. The second is we rolled out an enterprise-ready, industry-specific ERP for construction, manufacturing, not-for-profit, which is very disruptive for businesses that outgrow QuickBooks — but now they don’t have to outgrow us, because they’re on Enterprise Suite. Where did they use to go when they outgrew QuickBooks? SG: Typically, they would be either our highest-paying customers and the most pissed off, because they’d outgrow QuickBooks, but they didn’t want to go to the next solution. Right. What would they go to? Like Oracle, or what sort of level? SG: They would go to a NetSuite , as one illustrative example. And for most of these businesses NetSuite is just overkill. And that’s where Intuit Enterprise Suite now really serves an incredibly important sweet spot. And then the last thing we talked about is what I led with, which is Intuit Accountant Suite — now a platform where you can manage your firm, your work, your clients, all in one place and back to your original question of, “I’m using QuickBooks because of my accountant”, well, 65% plus of our customers are “attached” to an accountant, and based on what we’re rolling out, we want that to be 100%, because we see in our numbers the retention of a customer is much higher when they’re using an accountant, because accountants drive success and power their prosperity. Do accountants need you, or do you need accountants? And has that changed? SG: Both, both. I spend 40% of my time with firms — small, medium to large-size firms. And it’s a two-way relationship. And by firms, you mean accounting firms or business firms? SG: Accounting firms. They need us, they need someone — I don’t want to be overconfident — they need someone to help them reinvent themselves in the era of AI. That’s us, that’s what we just rolled out at Intuit Connect, because all of them, if they’re PE-backed, they’re getting a lot of pressure, if they’re not PE-backed, they’re having to compete with firms that are PE-backed. So automation, intelligence, advisory services matters. That’s what we just rolled out. And I need them because it creates a network effect and that really, in the era of AI, is a great place to be when you have a network effect. That’s an actual moat. So is it fair to say your pitch to accountants is basically, “Look, we’re all under the gun here — we’re better off banding together and figuring this out”? SG: Well, if you were to listen to my 25-minute keynote , where I revealed a lot of this product innovation, and you synthesized it and put it in Claude, it would probably tell you exactly what you just said — which is, “You need me, I need you, here’s what the innovation is we’ve done for you and here’s why it’s important”. But does that lead to innovation that actually — is just the reality someone like me is trapped, I’m going to go on with whatever happens and they’re going to figure it out? Or what is the actual threat here, that people just start using AI, the AI companies offer their own services? What are you banding together against? SG: It’s a great question. First of all, if you start with the jobs to be done, and jobs to be solved by businesses — they’re trying to get customers, they’re trying to grow with their customers, they’re trying to understand where their profitability is, they’re trying to get paid, they’re trying to manage their employees. And they’ve got to make sure their accounting and taxes are done right, because clean books. Right. Monopoly on violence — always good to have in your business model. SG: Yes, that’s exactly right. If you start with the jobs to be done, and what’s the role of an accountant? Oh good, that’s one of my questions — what is an accountant’s job? SG: The accountant’s job is to ensure that, one, advisory services — how should you grow your construction company? How should you grow your nonprofit? — making sure their books are clean. Wait, would you have ever said that was an accountant’s job five years ago? SG: No, it’s more important today. And why wouldn’t I have said that? Let’s talk about that. Because I used to run the accounting business at Intuit years ago, this is our pro-tax business, the reality is everything was manual, and all of the time, accountants were spending manually entering data to make sure your books are done right. Now, one of the things we rolled out at Intuit Connect is our agentic books close, where you can upload now your standard operating procedures and processes by firm, because every firm does books differently, and we automate a lot of that. That allows them to spend time on real value-added, “Hey, Sasan, here’s how you should think about growing your business”, “Here’s how many employees you should think about hiring”, “Here’s what inventory you can buy”. Is that a little bit like the mafia helping you? “We’re going to help you close your books”, your books are going to get closed, whether you want them to or not. SG: The reality is, businesses, we see this in our data, and remember, we have 100 million customers, 10 million of them are businesses. Businesses that are connected to accountants, our retention rates and profitability are generally higher. And so this is like real value that accountants provide, and back to your question of what’s different, I think what we’re now doing is making sure that they can run their firm far more effectively by automating and delivering intelligence, so they don’t have to do manual work, so that they can actually do a better job serving the business. And on the other side, we have a platform that the business uses to grow and run their business and it just creates this network effect in ways that I think is beyond, “I need to do manual work and I need to work in the workflow”, to an era of intelligence and insights and how can we grow faster with expected outcomes, where efficiency and profitability must improve because of what’s possible with AI. Are there more or fewer accountants in five years? SG: Fewer, many fewer. And are those accountants actually different people than the accountants today? SG: Well, I think by design, two things in life are true. You die, and you have to do taxes. Right. Is an accountant actually just selling a signature? Is that what they’re actually providing in the future? SG: No, they do a lot more than that, there’s only so much technology can do. Even tomorrow and the day after, as AI advances— SG: First of all, judgment. Closing books — that is really hard. Yeah. By the way, to my listeners, I love accounting. So you’re speaking to the choir here, but you still have to convince me. SG: I didn’t know that, but it’s good that at least this lands with someone that knows accounting. Categorization of all the financial data, making sure that you reconcile everything from a balance sheet to a GL [general ledger], making sure that all the revenues are recognized correctly and in the right categories. There’s a lot we’re doing to automate, but at the end, the judgment of, “Are the books right?”, “Are they clean?”, and then what choices and decisions can you make — that judgment and that intelligence will always, always be important. But I think if you think about a continuum where before it was 90% manual work and 10% judgment and intelligence to eventually, I don’t know when, a year from now, two years from now, it’ll be 90% intelligence and judgment and 10% manual work. I think about it just on a personal level. I had a longtime accountant, who unfortunately retired a couple years ago, and she loved me, she dealt with much larger companies and things. But at the time I was living abroad, I had this very high-cash-flow business. She’s like, “This is so interesting, you present so many weird edge cases and challenges that I’m not used to”, and I almost feel bad for her, because in a world of AI, she would crush it, because she’s exactly the accountant you’re talking about. The question I have, though, is this goes back to you being a generalist. I see someone like you — AI is incredible. I’d be curious to know what, if any, personal AI projects you might be working on because if you’re anything like me, it’s like, this is just so fun — you can do basically anything. That’s not your typical accountant, an accountant is like, there’s the beauty in the numbers, everything has to balance, credits versus debits, and also just a lot of drudgery, actually filling in the forms and making the files correctly, very conscientious, very careful, very high values — all of which seem pretty threatened. That’s why I’m wondering, not just how many accountants will there be, but what does an accountant look like? SG: First of all, there’ll be a lot fewer accountants because of what’s happening structurally, which is PE firms are gobbling them up . Was that happening before AI, or is that a post-AI phenomenon? SG: It was happening beforehand, because there’s just a lot of inefficiency, and PE firms look at that and say, “There’s a lot we can do”, and it’s just accelerating now with what’s possible with AI. I think that’s one reason. I think the other is I believe there will be accountants that are all-in on AI and accountants that are not and those that are not all-in on AI are the ones that are going to be disrupted and won’t be around two to three years from now. So that’s why, in general, I feel like there’s going to be fewer and fewer accountants. But here’s what I would tell you — and listen, you’re an accountant, I spend 40% of my time with them. I’m not an accountant, I just appreciate it. SG: The biggest thing I hear from them is they don’t really like doing debits and credits, they don’t like doing the manual work, and it’s the biggest cultural change they are focused on driving. And a big part of that, that we’re helping them with, is either training their folks, and/or for them to upgrade. I do think there’s going to be a massive change and upgrade of talent, either those that love the manual work are going to realize, “I have to love automation”, not doing manual work, or they’re just going to go get somebody else that will love that work — particularly these folks that are coming right out of college and want to be accountants and want to be CPAs, they’re much more tech-savvy, and they will want to drive automation. I think that’s the change you’re going to ultimately see, and we’re seeing it right now, because the top partners are driving it. If you look at your recent financial results, you’ve been growing revenue amongst your core customers, but barely growing total customers. Now you’re talking about going up-market, like into the accounting workstream, for example. You mentioned with businesses, your recent focus on ERP services. Again, going up-market, between that gap between NetSuite and yourself. All that makes sense. At the same time, you’ve brought up disruption, jobs to be done, you’re a student of this theory. A company going up-market, increasing average revenue per user, even as there’s a technological shift at the bottom that is gobbling up the business there — that sounds like a company that’s being disrupted ? SG: I love your question, I’m glad you’re asking it now versus four years ago. So we declared, in essence, these three bets that I’m talking about eight years ago. And what are those bets? If I were to simplify them, one is to disrupt assisted tax — out of the total tax TAM of $40 billion, $35 billion is assisted taxes — when you go have somebody else do your taxes for you, a human doing it. And it’s the signature that matters. Is the goal there that customers no longer need to hire accountants? SG: I’ll come back to that. So that’s one space. The second big space was shift from tax and accounting only to money, our money benefits and money portfolio being the core of our platform. What does that mean? It means bill pay, it means payments, it means instant deposit. And then the third is go to mid-market. When I declared this nearly seven-and-a-half, eight years ago, investors were very skeptical of me, because what they said was, “These are markets you don’t play in, you could screw up your margins, I’m very skeptical”. If you now fast-forward to where we are — to answer your question — it’s now 30% of the company, so it’s like $7 billion-plus, growing at 30%, we’ve already proven these. So is the answer to the old business is, we’re just going to outrun it with the new business? SG: That’s right. So AI is a huge tailwind for us, because we’ve been investing in it in these areas. The core business is — if you go back to Investor Day and what I just shared, I said, hey, we’re growing 30% of the company, my core business has slowed. I need to increase my market share, so I’m changing my lineup. Right, because isn’t the problem that your core business — maybe it’s not very sexy — but that’s the foundation of your new businesses? SG: That’s exactly right. And so that’s why we, in essence, what we’re doing is reinventing our product, but also being disruptive on price to take market share, while at the same time scaling my big bets because I want to make sure five years from now, we’re a healthy and growing company. Because here’s what I believe will happen with AI in our industry and in the spaces that I play in, AI is a tailwind for me with these big bets — disrupting mid-market, disrupting assisted [tax] — Just because you can develop software more quickly, or what? SG: My biggest differentiation in assisted tax is I have scaled the one thing that matters most, which is the human signature, virtually, at scale and I have a disruptive price. So I can do anybody’s taxes for them at a disruptive price with an amazing virtual experience, where you never have to leave your place of work or home and it’s an amazing experience. The differentiation is I have scaled the human signature because of AI. So that’s an example of — and my competitors are a lot of mom-and-pop shops and so scaling that for the next 10 years. You were saying “the signature”, are you talking about actual accountant signatures, or are you talking about, like, the TurboTax product where you’re actually— SG: We have about 18,000 experts that are CPAs, accountants, on our platform and those are the ones that are virtually doing people’s taxes for them. Got it, got it. So that’s a separate pool than your accountant business, I was conflating them in my head. SG: That’s right. I mean, the accountants that we’ve been talking about for the last 45 minutes are accountants that, they don’t even want to mess with somebody’s tax return unless it’s greater than $6,000, we don’t compete with them, we’re helping them grow their business. These are much more the normal Americans and the taxes that they pay. The reason I think we got on this topic is, for me, that’s a huge tailwind, AI is a tailwind to disrupt those industries. But I think for the lower end of the market, AI can help you reinvent experiences but if you’re not priced right, you’re going to get disrupted and that’s really what I’ve done. In the low end of the market, I’m reinventing experiences, but I’m adjusting my price-to-value ratio, so I can win these customers when they first come into the market, and then I can grow with them over time. I do have to ask you, because I hinted at it before — you acquired Mailchimp for $12 billion in 2021, a company that I originally worked with and left in part because I feel they send email people don’t want, and I send email people do want. The idea was extending QuickBooks from accounting into customer acquisition, that platform stopped growing, you’re segmenting it off , is that an acquisition that didn’t work out? SG: First of all, legendary brand, legendary product, legendary employees — full stop. I’ll come back to that in a moment. What we want to do hasn’t changed, the customer problem of helping customers grow has not changed, and so now we’ve built that AI natively within QuickBooks. Right, but you said before you’re building a money platform. Is the issue that Mailchimp doesn’t have anything to do with money, at least directly? It’s a secondary input. SG: Growing customers has everything to do with money, because eventually, they have to pay. So when I say “money”, it is, in fact, owning the right to the workflows that lead to money — which is why solving the problem of getting customers, which is what Mailchimp does, is something we’ve built out AI-natively within QuickBooks. But to your point, we have carved out — I don’t think we’ve executed well on Mailchimp, so we’ve carved it out separately to really focus on getting the business right and making sure it’s transparent how we’re performing externally and as I’ve said to investors and our employees, all options are on the table to make sure that it has the right future. All right, I want to get back to the more interesting question, because we’re almost at time here. To go back, to put this together historically — you went through one big business model change, from package software to subscriptions. What does the business model look like in 10 years? People talk about usage-based, outcome-based pricing — you’re not necessarily seat-based , so that’s a big advantage for you, you also have the affiliate marketing angle on your consumer side. What’s the core way that Intuit makes money in the long run, and is that going to be fundamentally different? SG: Three things I will say. One, first of all, you’re absolutely right — we’re not seat-based, so let’s get that foundation confirmed by me, that we’re not seat-based. I’ll say three things. The way we’re set up today is, we’re beyond user-paid, so the entire Credit Karma platform — everything for the user is free, but we get paid based on all of our partners on our platform, so that’s one business model. The other business model is subscription-based, which is our business platform is subscription-based — about 80%, 90% of it. The third is we’re transaction-based. Right. You file your taxes, you pay a certain amount of money. SG: That’s right. Or you invoice, and we get paid, a customer gets paid, that’s transactional. So those are the three models in which we operate today. If I were to answer your question five years from now, three years from now, not just 10 years from now, I think what will get added to that is consumption-based. SG: For instance, a lot of what we just rolled out at Intuit Connect is, if an accountant uses certain agentic capabilities, like creating specific tailored experiences for a construction company, and that construction company pays the accountant more for those services, which they will — we have the opportunity to monetize that consumption. Is that monetization — is that usage-based, or do you envision outcome-based pricing ? I mean, you are dealing with money. SG: No, no, it’ll be usage-based. Is there room for an outcome-based pricing model in any of this? SG: You know, there could be — I don’t want to fixate on “yes or no”, we test a lot of this with customers. What I would tell you — customers today, doesn’t mean tomorrow won’t change — generally, customers aren’t that interested in outcome-based pricing. They’re generally not interested in token-based pricing, because then they can’t control what they’re going to end up paying, so they still want an element of fixation of what I’m going to pay. Predictability, yeah. SG: That’s right. I think three years from now, the value of what they’re willing to pay for in certain markets will go up. In certain markets, it could go down. But I believe in three years, we’ll still have beyond user-paid, we’ll still have transactional, we’ll still have subscription, and I think there’s going to be a smaller element — and growing — that will be consumption-based. Do you feel like you’re on offense or defense? SG: Every day, we’re focused on playing offense and every day, I open my email to see what was launched yesterday, to figure out where we need to play defense. Very good. Sasan Goodarzi, thanks for coming on to Stratechery. SG: All right. Thank you for having me. This Daily Update Interview is also available as a podcast. To receive it in your podcast player, visit Stratechery . The Daily Update is intended for a single recipient, but occasional forwarding is totally fine! If you would like to order multiple subscriptions for your team with a group discount (minimum 5), please contact me directly. Thanks for being a supporter, and have a great day!
Author: RR Haywood Genre: Thriller Released: 07 September 2026 Rating: ★★★★☆ Find Ollie Perkins. There’s just one problem. Mike isn’t allowed to ask anyone about him. He can’t say his name. He doesn’t know what he looks like. So Mike takes a job as a security guard at a highly secure data facility on the edge of town and waits. Then things start happening. Lies get told. A body turns up. Foreign agents begin circling. Mike realises he's being watched and that he's not the only one looking for Ollie Perkins. The pressure soon mounts. Mike needs to find the target before more people die. BAITED is the third Mike Humber novel. A very different kind of British crime twist-loaded, contemporary, darkly funny, unpredictable and built around an ex-detective who survives largely through instinct, guile and an increasingly questionable relationship with authority. Learn more on Goodreads ➡ I'm growing to really enjoy the Mike Humber series. As Haywood develops the books, and Mike's character, we get more of an insight into the inner workings of his frankly, completely fucked mind. I've read a number of Haywood's books at this point and he's quickly becoming one of my favourite authors. His British whit and the way he writes is a breath of fresh air - it's nice to read someone who gets British sarcasm, but also dark humour. All the Mike Humber books end in a crescendo where seemingly unrelated threads come together in a really satisfying way. I'm yet to predict any of the endings too, which is makes the stories all the more enjoyable. Cracking read. Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️ You can reply to this post by email , or leave a comment .
Sometimes it’s useful to check how a Hugo site looks on a real mobile device before deploying. That requires serving the site on a local network so other devices on that network can access it. Here’s the command to serve a Hugo site on a local network: Then open on your phone. The site should load and work as expected. The option is necessary because Hugo binds itself to by default, which means no other devices except the one serving the site would be able to reach said site. The option is needed so that links generated in the Hugo site all point to the local IP address the site is being served from. Otherwise, the links will be generated with . Note that if you’re on public wifi this command may not work due to client isolation! If you need to get your local IP address, here are a few methods depending on your operating system. On macOS, try running: If it returns nothing, try instead. On Linux, try this command. The first address is usually the one you need: On Windows, try this command. Look for “IPv4 Address”: I felt the need to write this post because I tried this command that worked for loading the home page on my phone, but everything else was broken. I couldn’t tell if I was doing something wrong or if there was something wrong with Hugo. With this command, the home page loaded on my mobile device on the same local network, but clicking on any links to other pages of the site resulted in a connection error. That’s because the links are all generated with , which means the device tries to connect to itself and the Hugo server is running on a separate device. Using is necessary to get past this.
I have spent a significant portion of my career focused on helping folks securely manufacture, deploy, and manage the lifecycle of connected devices. I don’t think it would be an overstatement to say that my professional mission in life is to dramatically improve the status quo of device security. I recently changed jobs in service of that mission. While there is a fair amount of essential complexity in Public Key Infrastructure (PKI), which underpins many of the components of a secure device, a significant reason why securely manufacturing devices is so hard is because no one talks about it.
I’m happy to announce that neocaml 0.11 is out! I never got around to writing about 0.10, which was mostly about (a backend that talks to via its native editor protocol), but 0.11 is a different story. Its changelog is twice as long as that of any release before it, and by now I’ve stopped pretending that a grand 1.0 is just around the corner. 1 There’s a lot in there, but three things stand out for me - OxCaml support, indentation styles, and much better support for documentation. Here’s why… OxCaml is Jane Street’s set of extensions to OCaml - modes and modalities, kinds, unboxed types, stack allocation and so on. You can use them today with an OxCaml compiler switch, and Jane Street’s libraries use them all over the place. A lot of the heavy lifting happened upstream, as 0.26 learned to parse OxCaml, and Tim McGilchrist bumped neocaml’s grammars to it. Pieter Goetschalckx (the maintainer) once again cut an ABI 14 build of the release, so we didn’t have to break anyone’s Emacs. (see the 0.9 post for the whole ABI saga) Huge thanks to both of them! A grammar that parses the code is only half of the job, though. Here’s a bit of OxCaml: neocaml now highlights and indents all of this. The new keywords ( , , , , and ), modes and modalities, kinds, unboxed types and literals ( , , ), immutable arrays ( ) and comprehensions are all covered. The indentation follows the way lays out Jane Street’s own OxCaml libraries (e.g. , and ), which is why the body of an isn’t indented, while those of and are. 2 Kind definitions also show up in imenu and work with the defun navigation commands. If you don’t write OxCaml, nothing changes for you - plain OCaml looks exactly the way it did before. If you do, there’s nothing to turn on in neocaml. Just make sure Emacs sees your OxCaml switch and you’ll get its and as well. The docs have all the details. Here’s a confession - neocaml’s indentation used to be a bit of a mix. Some layouts followed ’s profile, some followed , and a few followed neither. That’s a problem, as OCaml doesn’t have one indentation style everyone follows. ships several profiles, Jane Street’s code doesn’t look like the compiler’s, and plenty of projects never run a formatter at all. So 0.11 lets you pick one of three styles via : They agree on most things and differ on a handful of layouts, e.g. how far the body of a match case goes: The best part is that most of the time you won’t have to pick a style yourself. By default neocaml looks for the project’s and picks the style that matches its (it also respects ). Without an it checks for an file, and without either you get the style, as that’s what most projects that don’t use indent with. (e.g. , Rocq, Frama-C, Eio and the compiler itself) You can also set the style per project in , or switch it for the current buffer with . I also wanted to know how well all of this works on real code, instead of guessing. So I wrote a couple of small scripts (they live in ) that format a bunch of OCaml files with each profile and count the lines neocaml would indent differently. I ran them on the almost 300 files of the packages in my default switch (mostly Jane Street’s ), and 0.10 didn’t look great. About one line in ten had no indentation rule at all, so simply left it wherever you typed it, and only 81.9% of the lines landed where ’s profile puts them (77.8% for ). Ouch! With the matching style, 0.11 gets 97.5% and 98% of them right. 3 Not perfect, but pretty close! Keep in mind that indentation only places the lines you’ve broken, it doesn’t break them for you. If you run on save it has the final word anyway, but with the matching style less of what you type moves around when you save. The third big theme is documentation. A few months ago mlemerre suggested ( #60 ) that neocaml should render the markup in comments, instead of showing it as a soup of braces. I loved the idea, and in 0.11 doc comments finally look like documentation - is bold, is italic, , and are shown as code, and and tags like get faces of their own. This is the new font-lock feature, and it’s enabled at the default font-lock level. Tim also contributed ( #46 ) for ’s standalone documentation pages, built on Tim’s own Tree-sitter grammar for . You get font-lock for headings, inline markup, references, links, tags, lists and tables, plus indentation and imenu. On Emacs 30+ the code in , and blocks is highlighted as well, using the grammars for those languages. Run to get started, and check out the docs for more. While I was at it, I also fixed and in comments. Embarrassingly, used to always fill the first paragraph of a comment, no matter where you were in it, and it merged code blocks into the text around them. now continues the of comments that start each line with one. Those are just the highlights, of course. Here are a few more things that I think you’ll like: Most setups will keep working just fine, but a few changes in this release require some action on your part: With OxCaml, mlx and on board, neocaml now covers pretty much every kind of OCaml file I can think of. Famous last words, right? So, what’s next? I don’t really have any big plans for 0.12. I’d like to switch to the dedicated grammar from once it has an ABI 14 release, and there’s the usual pile of smaller ideas in the roadmap . No promises, though. Big thanks to Tim McGilchrist , who did a ton of work on the grammars (OCaml, , and ) and the support! Thanks to Akira Komamura for bringing mlx to neocaml, and to Alessio Duè for fixing a sexp navigation bug! And thanks to everyone who reported problems and shared ideas - many of the improvements in 0.11 started as an issue on GitHub. As usual - update from MELPA , play with it, and let me know how it goes. The full list of changes is in the release notes . That’s all I have for you today. Keep hacking! See the 0.6 post for how that went the last time. ↩︎ That’s how formats Jane Street’s code, and I’ve learned to trust it more than my own intuition here. ↩︎ That’s about 77,000 lines formatted with 0.27.0. The numbers depend on the code and the ocamlformat version, so take them with a grain of salt. ↩︎ , which indents the way does out of the box , after ’s default profile (used by ocaml.org, ppxlib and Irmin) , after ’s profile (used by Jane Street’s libraries, and ) for files ( OCaml with JSX , as used by Melange and React), contributed by Akira Komamura commands for running the tests of the current file and dealing with ’s promotions ( , and ), with their own bindings in the toplevel’s responses in the REPL are now highlighted with Tree-sitter, just like your code each project in a monorepo gets its own REPL replaces only the text that changed, so point and the window positions stay put neocaml needs 0.26 now, so reinstall the OCaml grammars with . The grammar moved to its new home, , so reinstall it as well with . neocaml will warn you if your grammars are too old. Some keybindings clashed with and , so they had to move. In the REPL minor modes sending the phrase at point is now , sending it and moving to the next one , loading the file and interrupting the toplevel . The commands moved from to . The default indentation changed. If your project uses neither nor a few layouts will move, so set if the style is not your cup of tea. See the 0.6 post for how that went the last time. ↩︎ That’s how formats Jane Street’s code, and I’ve learned to trust it more than my own intuition here. ↩︎ That’s about 77,000 lines formatted with 0.27.0. The numbers depend on the code and the ocamlformat version, so take them with a grain of salt. ↩︎
Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President ( AS2650 ). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period. The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica , a proxy program that is often integrated into “free” mobile and desktop applications . Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016. Synthient’s depiction of the frequency of outgoing proxy traffic from the dedicated White House network (AS2650). Click to enlarge. There are dozens of residential proxy providers with varying degrees of legitimacy, many of them based in China or Russia. But at a minimum, they all make it simple for customers to rent someone else’s internet address as a way to anonymize their web traffic or spoof their true location. From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer. Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight. Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network . “This is public access,” the Layer3 Intel team wrote . “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services.” The White House did not immediately respond to a request for comment. As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover and other cybercrime activity, advertising fraud, and mass content scraping for AI projects. They can also introduce serious security risks. In late 2025, it was discovered that cybercriminals were mass exploiting a widespread vulnerability in these services that allowed them to probe each proxy endpoint’s local network for vulnerable systems to infect with malware. In January 2026, dozens of proxy services were forced to patch their networks after Synthient Founder Ben Brundage showed how cybercriminals were abusing a vulnerability in these residential proxy services to seize control over devices inside the local networks of unsuspecting users. “Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks,” Brundage told KrebsOnSecurity. “The reseller ecosystem further enables this with any criminal able to buy access while skipping KYC [Know Your Customer] processes.” All too often, these proxy services are beaconing out from employee devices brought into the workplace. App developers can embed software development kits (SDKs) provided by the residential proxy networks to monetize their software, allowing them to receive a small amount of money on each installation. As risky as residential proxies can be for unsuspecting end users, they are all too commonly found on government and corporate networks. In a webinar in January 2026, the proxy tracking service Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance. In a blog post earlier this year, the security firm Infoblox said it discovered that fully 65% of its customer base was querying one or more residential proxy related domains.
Last month, I learned that it’s apparently not common behavior in computer users to start fiddling with the URL of a link that they receive, just to see what happens. “It wouldn’t even come to my mind to do that!” was one reaction. And that’s how I ended up discovering a vulnerability on a service that I personally used. Unlike most security vulnerabilities that get reported nowadays, it didn’t take me a fleet of token-thirsty LLM-based agents to get the job done. I just noticed that the e-mail with my order had a number in it, it served as a share code, and then I began iterating it a few times to see what happens. Plain old human curiosity. Then a few numbers later I stumbled upon someone else’s account. I let the company know about the issue politely and with detail and potential mitigations, and after a week of back-and-forth, they actually implemented the fixes that ensure that both old orders and any future ones are now appropriately handled, minimizing the risk of a data leak and potential malicious actions on behalf of other customers. Before you take the title of this post literally, there are a few basics to follow to get it right: Depending on your jurisdiction, there may also be other things to pay attention to. This is not legal advice. You don’t need to hack the world, but if you notice an obvious issue in passing, then it’s worth putting in that little bit of effort to make the security world a better place, especially if it’s a service that you use, since your personal data is also stored on there. This type of vulnerability is unfortunately super common and almost every software system that I’ve helped build and maintain has exhibited this in one way or another. I suspect with the onslaught of low-quality LLM-written code, it may be even more common because LLM-s can very easily introduce these issues unless you take steps to weed this behavior out or introduce explicit rules that try to mitigate common vulnerabilities in new code. Happy responsible hacking! be curious but not actively malicious once you have validated a hunch, STOP and report the issue, you don’t need to pull the whole customer database to prove a point try to prove the vulnerability with two test accounts that you control to avoid exposing someone else’s actual private information, intentionally or accidentally if you can’t find any contact details or get ignored, loop in your local regulator who deals with cybersecurity matters, such as CERT-EE in Estonia they do good work and alerted me of a now-shutdown public Kiwix instance that had a security flaw back in 2023!
I’m on my way back from RustLab 2026, where I gave a lightning talk about all the ways to create a in Rust that don’t involve . The talks were not recorded, so I decided to write it up as a blog post. Collect Some Characters One of the most obvious ways to create a string without calling is to collect some characters into a string: Alternatively, you can start with the UTF-8 bytes: Derive Debug If we derive for an enum, we can format a variant as a string. Note that debug output isn’t a stable serialization format, so this just happens to work for this particular string. Use a CString This is another very obvious one: we can use to create a string with a NUL terminator, then convert it back to a . Converting it back removes the terminator and checks that the remaining bytes are valid UTF-8. Use If we supply an invalid string to , it will return an error instead of panicking. We can abuse that fact and call on the result to get the error, which gives us the rejected bytes back . All we have to do now is remove the invalid NUL byte we added: Now we can convert each byte back to a character. is safe because every value (0–255) corresponds to a valid Unicode character. It does not decode UTF-8; it simply converts each byte into a Unicode code point. When collecting these characters into a , Rust automatically encodes them as valid UTF-8. Therefore, the conversion cannot fail, but the resulting text may be incorrect if the original bytes represented multibyte UTF-8 characters. Statically include some text with Create a file called containing exactly , without a trailing newline. In another Rust file, we can include that text at compile time: The extension doesn’t matter. embeds the file as UTF-8 text at compile time; it doesn’t try to parse it as Rust. Thread Shenanigans Threads can have names, and we can read the name of the current thread. We can abuse that to create a string by naming a thread and then reading its name from another thread. Then let it read its own name and send it back: The name is borrowed from the thread handle; that’s why we copy it into an owned string. Ask Another Process Instead of threads, you can also spawn a child process and read its output. The child prints the string and exits. The parent waits for it, checks its exit status, and converts the captured stdout into a . Store It in a Float Those bits, read as little-endian bytes, are . We can use to avoid the numeric conversion of these bytes. Now extract the characters and discard the two padding bytes: Note how I use and here. That’s because these are two separate variables, not characters. Using makes this independent of the machine’s byte order. All we have to do is format the variables back into a string. Assemble a String From Raw Parts A in Rust is just a pointer to a heap allocation, along with a length and capacity. We can manually create an instance of that type, but we have to be careful to get the layout, length, capacity, and UTF-8 validity right ourselves. gives up ownership without freeing the allocation. The takes over and will free it when dropped. Using the Type Name Every type in Rust has a name. We can use to get the name of a type as a string. So if we create a type with the string we want, we can get that string back from the type name. The name can include the module path, so we take the last component, then “parse” it as a string: Note that does not have a stable naming API, so the exact output is unspecified. Deliver It Through a Panic Maybe one of my favorite ways to create a string is to panic with it and catch the panic. That works because the panic carries an owned . Catching it gives us the payload, downcasting gives us a , and dereferencing moves the string out of the box. This requires unwinding . With , the process would just exit instead. Use Only Padding is one of the most powerful macros in the Rust standard library. It supports “format specifiers” that let you control how the output is formatted in exactly the way you want. One feature is , which right-aligns the output and pads it with a fill character. The character before in a format specifier is the fill character. The number is the minimum width: Knowing this, we can completely abuse specifiers to pad an empty string with each letter we need. Argument lets us reuse the same empty string: So we take an empty string and pad it with , then , then twice, then , then . I like how we use to get two s instead of writing twice like a peasant. That was fun! This little exercise is not completely useless. Trying to solve a familiar problem in an unfamiliar way can teach you something new. One more way I didn’t have the time to show in the talk is to use to extract random bytes from memory and hope they form the string you want. Apart from that, did I forget an interesting way to create a string? Let me know on Mastodon . You might also like my 2023 RustLab lightning talk on Printing Things The Wrong Way .
Reference to Monsoon deck and Reference to RWS deck. Mostly for my own use, but you might use that too if you want!
A fun video from Vidya James about a specific moment in The Legend of Zelda: Majora’s Mask on Nintendo 64 that starts with a bug (similar to this thing we talked about once ), and ends with a fun effort to find the perfect conditions to put that bug to some good use: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/everybody-loves-a-good-underdog-story/yt1-play.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/everybody-loves-a-good-underdog-story/yt1-play.1600w.avif" type="image/avif"> This is in some way adjacent to the Mega Man glitch story , and also the Quake speedrun story , but there’s a few different angles here: statistics, brute forcing, and code analysis. But I also feel like this in a strange way talks not just about perseverance, but also the value of… prototyping, maybe? Some people can see in their mind’s eye a faraway goal and aim for it. For others, seeing a smaller step succeed opens up their horizons: “If this worked… what if we aimed for something even further next?” This video has a few of these moments, but I don’t want to spoil it.
There’s that famous video of Steve Jobs explaining why they don’t didn’t make touchscreen MacBooks: We thought about [a touch screen MacBook] years ago. We’ve done tons of user testing on this and it turns out it doesn’t work! Touch surfaces don’t want to be vertical. It gives great demo. But after a short period of time, you start to fatigue. And after an extended period of time, your arm wants to fall off. It doesn’t work. It’s ergonomically terrible. Touch surfaces want to be horizontal […] that’s why we’ve perfected our multitouch trackpads over the years. I’m not going to weigh in on the new MacBooks. But what I find specifically intriguing in this video — and broadly relevant — is that phrase: “It gives great demo.” Damn, that is a great line for so much of technology. “It gives great demo.” Something that looks amazing when it’s presented to you, but in practical day-to-day use you discover, “Actually this is kinda terrible.” Demo is everything nowadays. Whatever can garner attention. Who cares if it works in practice, does it give great demo? Because demo time is sale time. The purpose of a demo is to get your attention. To make you think about the product and that it exists. But a great product often makes you forget it exists at all. It seems like a paradox: we’re attracted to what stands out, but we become enamored with what disappears. Of course, this doesn’t just apply to products. People can give great demo, too. You can make a whole career out of just giving great demo. Reply via: Email · Mastodon · Bluesky
Business
Data
AI
Programming
Design
Web Development
Database
Backend
Ruby
Hardware
Testing
DevOps
Cloud
Go
Entertainment
Books
Tutorial
Security
Linux
Rust
Culture
Gaming
Statistics
Marketing