Latest / DevQuestions with Tim Corey / 306. The Dangers of Fast-Moving Development with AI

Transcript

306. The Dangers of Fast-Moving Development with AI · DevQuestions with Tim Corey

• 0:00
  SPEAKER_01: Right now, GitHub is struggling just to work.
• 0:03
  SPEAKER_01: They've lost all their nines of availability.
• 0:05
  SPEAKER_01: They might get one back soon.
• 0:07
  SPEAKER_01: But they are really struggling just to stay up and running.
• 0:11
  SPEAKER_01: The amount of code that's on GitHub is skyrocketing.
• 0:15
  SPEAKER_01: And this is a major reason why they're struggling.
• 0:18
  SPEAKER_01: Last year, they had 1 billion commits on GitHub.
• 0:22
  SPEAKER_01: This year, they're on track for 14 billion commits.
• 0:27
  SPEAKER_01: And that's probably a low estimate.
• 0:29
  SPEAKER_01: It feels like every company is accelerating how many changes are made to their applications each month.
• 0:35
  SPEAKER_01: VS Code used to get a version update every month.
• 0:39
  SPEAKER_01: Now it's every week.
• 0:41
  SPEAKER_01: In theory, that means more bugs are getting fixed faster.
• 0:45
  SPEAKER_01: In practice, it doesn't really feel that way.
• 0:48
  SPEAKER_01: In fact, it feels like we're seeing more bugs than ever in production.
• 0:54
  SPEAKER_01: And that these products used to be stable and now they're not.
• 0:58
  SPEAKER_01: So is there a point where things move too fast?
• 1:02
  SPEAKER_01: Is AI-powered development helping us move too fast, or are we just not prepared to move as fast as we are?
• 1:10
  SPEAKER_01: That's what we're going to discuss in today's episode of DevQuestions.
• 1:21
  SPEAKER_00: Welcome to the Dev Questions Podcast with Tim Corey.
• 1:25
  SPEAKER_01: Software development is more than just writing code.
• 1:28
  SPEAKER_01: So let's talk about the rest of it.
• 1:30
  SPEAKER_01: Specifically, let's talk about the dangers of moving too fast in software development.
• 1:35
  SPEAKER_01: Now, for years, software developers have known about the dangers of just adding people to a software development project.
• 1:42
  SPEAKER_01: Frederick Brooks wrote the book The Mythical Man Month back in 1975, talking about how adding developers to a late project will make it later rather than make it get released faster.
• 1:55
  SPEAKER_01: The concept is that adding people adds complexity, and that complexity slows down work.
• 2:01
  SPEAKER_01: This concept is over 50 years old, well older than AI, and yet now companies are forgetting all these lessons learned because they think that AI is somehow different.
• 2:12
  SPEAKER_01: Unfortunately, at its absolute best and guided by a skilled operator, AI is still not the equivalent of a software developer.
• 2:20
  SPEAKER_01: However, it can put out a lot of code.
• 2:24
  SPEAKER_01: Companies are pushing developers to run more and more agents to create more and more code faster and faster.
• 2:30
  SPEAKER_01: Let's pretend for a minute that each of these agents was a person.
• 2:35
  SPEAKER_01: What would that mean for a project?
• 2:37
  SPEAKER_01: If a project that had five developers on it suddenly had 25 developers on it, how would that change things?
• 2:44
  SPEAKER_01: A lot of things would get done, right?
• 2:46
  SPEAKER_01: But there'd also be a lot of communication issues.
• 2:49
  SPEAKER_01: Code would be duplicated as various people solve similar problems.
• 2:53
  SPEAKER_01: Features would be added that overlap other in-development features.
• 2:57
  SPEAKER_01: The roadmap would be a mess as people did work faster than the planning could keep up with.
• 3:03
  SPEAKER_01: And guess what?
• 3:04
  SPEAKER_01: That's exactly what's happening.
• 3:06
  SPEAKER_01: So let's talk about the problems of moving too fast.
• 3:10
  SPEAKER_01: Number one, moving fast means less gets evaluated properly.
• 3:16
  SPEAKER_01: Now, if you've ever reviewed a pull request or a PR, if that pull request is five lines, ten lines, twenty lines of code, you tend to evaluate that very deeply.
• 3:30
  SPEAKER_01: What are these lines?
• 3:31
  SPEAKER_01: Is it the right lines?
• 3:32
  SPEAKER_01: Should we change this?
• 3:33
  SPEAKER_01: Should we tweak this?
• 3:34
  SPEAKER_01: Is it line up with how we're doing things?
• 3:36
  SPEAKER_01: Now imagine if that pull request was a thousand lines of code.
• 3:41
  SPEAKER_01: We can see from how people interact with pull requests that the more lines of code there are, the less time gets spent evaluating that pull request.
• 3:51
  SPEAKER_01: And on average.
• 3:52
  SPEAKER_01: Now, sure, maybe you're a great, you know, you're a good citizen, you review everything equally.
• 3:57
  SPEAKER_01: But you probably don't.
• 3:58
  SPEAKER_01: Because if you did and you got a thousand-line pull requests, that would slow you down to a crawl where you'd spend hours and possibly even days evaluating that code.
• 4:08
  SPEAKER_01: But if you have 10 of those, if you have one of those a day, then it's going to be too much for you to do anything but review.
• 4:16
  SPEAKER_01: So what's going to happen is the faster people move, the more AI does work, the less it's going to get evaluated properly.
• 4:27
  SPEAKER_01: Now you may say, well, the AI writes great code.
• 4:30
  SPEAKER_01: It doesn't, but cool.
• 4:32
  SPEAKER_01: Let's just say it does.
• 4:33
  SPEAKER_01: They've tested and said in the perfect conditions, that no matter what AI you use, it has at least a 1% hallucination rate.
• 4:43
  SPEAKER_01: So 1% of that code is going to have problems, at the very least.
• 4:48
  SPEAKER_01: Now the reality is it's much, much higher than that because code doesn't exist in a vacuum.
• 4:53
  SPEAKER_01: Remember, I said perfect conditions?
• 4:55
  SPEAKER_01: Your code base isn't perfect.
• 4:57
  SPEAKER_01: So it's going to have problems.
• 5:00
  SPEAKER_01: But the more you do, the more you the faster you move, the less that's going to get evaluated properly.
• 5:08
  SPEAKER_01: That's going to mean bugs.
• 5:09
  SPEAKER_01: That's going to mean problems.
• 5:11
  SPEAKER_01: And they're going to escalate because you're doing more faster.
• 5:14
  SPEAKER_01: Number two, moving fast means you spend less time planning and considering.
• 5:20
  SPEAKER_01: Too often, people think that the thing that developers do is write code.
• 5:25
  SPEAKER_01: When a you know a brand new rookie developer, when you give them a project, you'll watch the very first thing they often do is open up Visual Studio.
• 5:35
  SPEAKER_01: And that means what they want to do is start writing code.
• 5:40
  SPEAKER_01: But that's not the starting point for any change that you need to make.
• 5:45
  SPEAKER_01: You should be planning that out first.
• 5:48
  SPEAKER_01: So when you move fast, you spend less time evaluating and considering.
• 5:53
  SPEAKER_01: So you're less likely to eliminate certain things, to not do certain things.
• 6:00
  SPEAKER_01: So you just do more.
• 6:02
  SPEAKER_01: And you say, hey, you know what?
• 6:03
  SPEAKER_01: I got some ideas.
• 6:04
  SPEAKER_01: Let's put it down on a piece of paper and you know we have time now, so let's just go ahead and do that.
• 6:09
  SPEAKER_01: I've heard from people, even at the in Microsoft, who said, normally we wouldn't be doing this, but we have a time because of AI, so you will.
• 6:19
  SPEAKER_01: Well, that sounds great until you realize that they're moving so fast that sometimes they don't have time to plan and consider like they otherwise would.
• 6:29
  SPEAKER_01: They're not choosing good, better, best.
• 6:31
  SPEAKER_01: They're choosing all of the above.
• 6:33
  SPEAKER_01: And that means some bad things will go to production.
• 6:37
  SPEAKER_01: Number three, moving fast means you write more code.
• 6:41
  SPEAKER_01: And you might say, okay, that's fine, but it's not because your code is a liability.
• 6:48
  SPEAKER_01: The more code you have, the more of a liability you have.
• 6:52
  SPEAKER_01: And here's what I mean by that.
• 6:54
  SPEAKER_01: When you have a hundred lines of code to support, maybe you have a little application in production, it's a hundred lines of code, it's tiny, minuscule.
• 7:03
  SPEAKER_01: Imagine for a minute that you have a bug.
• 7:05
  SPEAKER_01: How easy is that to fix?
• 7:07
  SPEAKER_01: Super easy because it's only one of those 100 lines of code, or maybe a few of them, but it's only that little spot.
• 7:14
  SPEAKER_01: And if you're going to support the features that you provide, well, you can't provide many features in 100 lines of code, therefore, there's not much to support.
• 7:24
  SPEAKER_01: But as you add more features and the code grows, you have more things to support.
• 7:30
  SPEAKER_01: You have more options to support, to the point where you have infinite options once you get to a certain spot.
• 7:38
  SPEAKER_01: And this is where Windows is, quite frankly, right now, where Windows is backward compatible.
• 7:46
  SPEAKER_01: I think made a Windows 3.1 in some places where you can have code that is 20, 30 years old and it will still run in Windows 11, which is wildly impressive.
• 7:58
  SPEAKER_01: But it also means there's a lot more to support.
• 8:02
  SPEAKER_01: There's a lot more potential issues.
• 8:03
  SPEAKER_01: They also support a lot more CPUs and GPUs and motherboards and all these other things, which means there's a lot more potential that can go wrong.
• 8:14
  SPEAKER_01: And as we've seen recently, a lot more is going wrong.
• 8:18
  SPEAKER_01: The more code you write, the more you have to support.
• 8:23
  SPEAKER_01: So that's a liability, not a benefit.
• 8:27
  SPEAKER_01: Therefore, that's gonna be a problem.
• 8:30
  SPEAKER_01: Number four, moving fast means you have even more features to support.
• 8:34
  SPEAKER_01: It's kind of like our kind of related to that more code, right?
• 8:38
  SPEAKER_01: The more features you have to support, the more you have to think about interactions with those features.
• 8:44
  SPEAKER_01: Let's say you have a notepad, right?
• 8:47
  SPEAKER_01: And you just put text in there and it you it saves text and it gets text out.
• 8:51
  SPEAKER_01: Great, cool.
• 8:52
  SPEAKER_01: Not a lot to support.
• 8:54
  SPEAKER_01: Now imagine that you allowed markdown in there.
• 8:57
  SPEAKER_01: Well, all of a sudden, now you have to make sure that the markdown uh raw text to the HTML equivalent is secure.
• 9:07
  SPEAKER_01: Microsoft had a major bug with that this past year, where there was a flaw in there that could cause some serious issues in Notepad because it has more features of support.
• 9:20
  SPEAKER_01: And all of a sudden, now you have people saying, hey, when I open this type of file, I do this type of action, this happens.
• 9:29
  SPEAKER_01: Well, you didn't test every potential combination of doing this and that because of the fact you have more and more to support.
• 9:38
  SPEAKER_01: It used to be you had two or three different options, and that was it.
• 9:41
  SPEAKER_01: Now you have thousands of options because when you have five different things it could do, and in five different ways, all of a sudden it's not just five or ten, it's 25 or it's 125.
• 9:54
  SPEAKER_01: Like it starts to multiply out.
• 9:58
  SPEAKER_01: So having more features means a lot more to support.
• 10:02
  SPEAKER_01: Number five, moving fast means everything is less stable and less predictable.
• 10:09
  SPEAKER_01: Now you may say, well, we're fixing bugs, you know, left and right.
• 10:12
  SPEAKER_01: Yes, but every change that you make has a potential to cause other issues, unexpected issues.
• 10:18
  SPEAKER_01: And again, let's go back to Windows from that.
• 10:20
  SPEAKER_01: I hate to pick on Windows, but they're a pretty obvious one we've all seen.
• 10:23
  SPEAKER_01: And that is that Microsoft has been putting out in 2025, they put out a whole bunch of, you know, this is a new release where we have new features we're adding to Windows, where, you know, we're fixing these bugs.
• 10:35
  SPEAKER_01: And then they put out a security fix almost immediately.
• 10:39
  SPEAKER_01: Hey, this is gonna fix the security flaws we introduced that last release.
• 10:42
  SPEAKER_01: And then they put another security fix to fix the security fix that fixed the initial issues.
• 10:48
  SPEAKER_01: And they did that a number of times where it wasn't just that they caused a problem with a new update, even the updates to the update cause a problem.
• 10:57
  SPEAKER_01: And the more things change, the harder it is to predict because you have more things to check, you have more plates to keep spinning the air, and everything becomes a little bit less stable.
• 11:12
  SPEAKER_01: Number six, moving fast means you increase the chances that your product will catastrophically fail.
• 11:19
  SPEAKER_01: So when you have a tiny product, again, we're gonna come back to Notepad again.
• 11:24
  SPEAKER_01: Everyone knows Notepad, right?
• 11:26
  SPEAKER_01: Um, Notepad had a tiny little product set, right?
• 11:30
  SPEAKER_01: It was it was super tiny.
• 11:32
  SPEAKER_01: It was just, I store text and that was it.
• 11:35
  SPEAKER_01: Well, now we have markdown support, now we have dark mode support, now we have tabs, now we have um uh you know bolding and italics and all the rest of these things.
• 11:45
  SPEAKER_01: Guess what that did?
• 11:47
  SPEAKER_01: That increased the surface area for attack.
• 11:50
  SPEAKER_01: And in fact, we had a major exploit this past year in Notepad.
• 11:54
  SPEAKER_01: So that can be a catastrophic problem.
• 11:58
  SPEAKER_01: Now in Notepad, it's not a big deal.
• 12:00
  SPEAKER_01: If Notepad went up in flames, it wouldn't be the end of the world, right?
• 12:04
  SPEAKER_01: If if Microsoft said we have to delete Notepad, it's just too bad.
• 12:08
  SPEAKER_01: Yeah, we'd grumble and complain, but there's other, you know, Notepad is right there.
• 12:13
  SPEAKER_01: Just go grab that instead, right?
• 12:14
  SPEAKER_01: There's other options.
• 12:16
  SPEAKER_01: But at the same time, there's a lot more serious products.
• 12:21
  SPEAKER_01: Imagine for a minute that you are a retailer, you're an online retailer, you're selling things to the public.
• 12:28
  SPEAKER_01: And initially you just sell products and you have a shopping cart and that's it.
• 12:33
  SPEAKER_01: But you keep adding more and more features because AI allows you to.
• 12:38
  SPEAKER_01: You can move faster.
• 12:39
  SPEAKER_01: But imagine if one of those features has a security flaw, which we've seen a lot this past year.
• 12:46
  SPEAKER_01: Well, if that is the case, you might lose all of your customer data, or it might corrupt all of your customer data.
• 12:54
  SPEAKER_01: Maybe it's not a security flaw, maybe it's just bad code that corrupted the data and cross-compiled it in a way that you can't unwind.
• 13:03
  SPEAKER_01: What do you do?
• 13:04
  SPEAKER_01: If all your company data is gone, that might shut your business down.
• 13:10
  SPEAKER_01: Or imagine for a minute that you have 10,000 lines of code, you're a single developer, and you maintain those 10,000 lines of code in production.
• 13:19
  SPEAKER_01: Cool.
• 13:20
  SPEAKER_01: AI comes along and that goes from 10,000 to 150,000 lines of code.
• 13:26
  SPEAKER_01: You've got lots more features, lots more things to do.
• 13:29
  SPEAKER_01: That's a lot to maintain as a single person, but you have AI, right?
• 13:33
  SPEAKER_01: Yeah, but imagine if you start getting 10 times the bugs because you have 10 times the code or 15 times the bugs.
• 13:40
  SPEAKER_01: You have 15 times the code.
• 13:41
  SPEAKER_01: Well, if in and believe me, it's not gonna be linear like that, right?
• 13:46
  SPEAKER_01: You're gonna have more than that.
• 13:47
  SPEAKER_01: But let's just say you have 15 times the bugs.
• 13:50
  SPEAKER_01: Well, that's a lot to maintain, and you're gonna get overwhelmed, the point where you do nothing but fix bugs.
• 13:57
  SPEAKER_01: But again, like Microsoft saw, you start to fix the bugs which cause other bugs.
• 14:02
  SPEAKER_01: And you might get overwhelmed to the point where your application just won't work.
• 14:08
  SPEAKER_01: And you you're stuck.
• 14:10
  SPEAKER_01: You're in a place where you may crash your business.
• 14:13
  SPEAKER_01: And we've seen a number of businesses this past year where they were built by AI and software product, software as a service, and they'd launch this product and it worked well for a while, and then the entire business would collapse because they exposed all our customer data or it couldn't do what they said it could do, and they, you know, the product didn't work the way they thought it was going to work, and so it just failed, and it left a lot of people in a vulnerable state because of the fact they relied on a uh piece of software that just catastrophically failed.
• 14:50
  SPEAKER_01: So it's a very big danger.
• 14:53
  SPEAKER_01: Number seven, moving fast means your product will easily become bloated.
• 14:59
  SPEAKER_01: When you can choose only one feature to add to a product, you're very careful about which one is the right one.
• 15:09
  SPEAKER_01: When you could choose all the features, it's really tempting to do so.
• 15:15
  SPEAKER_01: And before you know it, you're choosing way too many features.
• 15:19
  SPEAKER_01: And your product, which was super simple, super focused, your customers love it, it's fast, it did the one thing well.
• 15:26
  SPEAKER_01: All of a sudden now it does everything.
• 15:28
  SPEAKER_01: And they get frustrated because it's not easy to use, it's it's slower, and most of the stuff they don't want to do.
• 15:35
  SPEAKER_01: And so they start looking for alternatives.
• 15:38
  SPEAKER_01: So it's very easy to make your product bloated when you can choose more options than you otherwise could have.
• 15:47
  SPEAKER_01: Now, about 2600 years ago, Aesop wrote a fable, or at least told the fable, of the tortoise and the hare.
• 15:57
  SPEAKER_01: The lesson was that slow and steady wins the race.
• 16:01
  SPEAKER_01: AI hasn't changed that lesson.
• 16:03
  SPEAKER_01: In fact, we're seeing over and over that just reinforced that lesson.
• 16:09
  SPEAKER_01: Product development that is driven by how fast you can produce code is always going to fail in the long run.
• 16:16
  SPEAKER_01: It will look flashy, it will even make big progress at first.
• 16:21
  SPEAKER_01: But failure is inevitable.
• 16:23
  SPEAKER_01: Instability, product blow, inconsistent features, and security vulnerabilities will happen as a result of moving too fast.
• 16:31
  SPEAKER_01: Take your time, plan your work, check what you are developing.
• 16:37
  SPEAKER_01: Write the code.
• 16:38
  SPEAKER_01: Writing the code was never the most important part.
• 16:42
  SPEAKER_01: Knowing what to write, knowing when to write, and knowing how to integrate it into your whole the whole are still much more important parts of software development.
• 16:53
  SPEAKER_01: All right, thanks for listening.
• 16:55
  SPEAKER_01: And as always, I am Tim Corey.
• 16:57
  SPEAKER_00: Thank you for joining us for this episode of Dev Questions.
• 17:00
  SPEAKER_00: When you're ready to learn to think and code like a professional developer, head over to Iamtimcorey.com and enroll in a course.