DHH · 2026-08-26 · source ↗ · whole document (26)
Fatherhood
`3:32:44`
Because then you erase the whole thing and you-... bias everyone towards thinking like, every guardrail you put up is gonna be bullshit.
`3:33:01`
Shockingly an- I was about to say annoyingly, but that's not actually true because what it's finding, at least when you're using in defensive ways, is it's finding real issues that a clever hacker could exploit. But nothing has caused as much stress, to be fair, at the technical team at 37signals, like the fact that these latest batches of models are exceptionally good at finding these issues. So suddenly there's just this seemingly endless parade of security vulnerabilities that need to be patched and fixed and sorted and so on. And the end result is we end up with vastly more secure systems. But the road there is pretty rocky.
`3:33:59`
I do think that all the aggressive tendencies of these models, or not even tendencies, uses of these models are also the defensive ones. So if you're good at finding an exploit for exploits, you're also good at finding exploits for defense. So in that sense, it does feel like we're spy versus spy here, black and white, but with the same capabilities and with the same actions. But while we still have to steer these agents somewhat and verify and vet the work, it's creating a lot of intense moments for security teams around the world. And of course, the more concerning part is all the teams that are not stressed, like they just don't know, right? Like if you're a team right now and you're not dealing with a bunch of patches, it's just because you're blind, and it means that your adversaries quite probably have access to techniques that can get into your system.
`3:35:19`
This stuff is gonna come, and it's gonna come in bulk. But again, I choose to be optimistic about it that-... whatever these models can do aggressively, they can also do it defensively.
`3:35:42`
It's a hell of a milepost for what's possible at the moment. And the reason I said it like that is not that I haven't worked on anything else of note. I've worked on a lot of things of note, a lot of things that I'm very proud of. There are very few other projects that I have worked on that in the amount of time that I've spent on Quattro, which is really three months, I have been able to accomplish as much, fulfill as many hopes, desires, wishes. It truly is like the metaphor we used earlier about finding the genie in the bottle-... and having an unlimited number of wishes, more or less, for getting everything I wanted out of a system. So it's strange because it's also perhaps the major software release that I've worked on the least in terms of lines of code. I have the least number of personally hand-chiseled lines of code in Quattro than I've had in any major release I've ever done. And yet, I am insanely proud of what we've accomplished. I would not have guessed that that was how it was gonna play out, that you could divorce the sense of achievement and make it be like a team victory. where other releases, I was very happy for my personal contribution because, like, I was the one chiseling out the lines of code, and then I would push it out there, and then later on, of course, these projects, Rails in particular, would grow into be huge open source projects with thousands and thousands of contributors, and then it certainly was a team effort.
But in the beginning, all code bases that I've almost all of them that I've worked on, I started, like, just myself. And Quattro started as a team effort right from the get-go, and where I was just the coach. I was telling us-- I was telling the agents where to go, and we would go. So to be able to find satisfaction in that actually gives me great hope for retirement in some way, that there is a phase after playing that you can enjoy. And I know that's not easy. You look at sports and the number of professional athletes who really struggle to cope with the fact that their career is over and have to find a new identity as someone who doesn't play football or race Formula 1 cars. I mean, it's more the rule than the exception. So I wasn't so sure about myself. I wasn't so sure about having to give up or not even having, wanting to give it up. Wanting to play another level of the game and finding not just equal satisfaction, but more satisfaction in it.