WEBVTT 00:00:00.000 --> 00:00:07.000 Welcome to No Compromises. A peek into the mind of two old web devs who have seen some things. This is Joel. 00:00:08.000 --> 00:00:09.000 And this is Aaron. 00:00:16.000 --> 00:00:22.000 I love the packaged ecosystem in PHP and Laravel specifically. You can get all these different packages to do whatever you want, 00:00:23.000 --> 00:00:29.000 and that saves a ton of time. But, I think we kind of talked about this before. There's always a risk with these packages, right? 00:00:30.000 --> 00:00:36.000 Do you read the entire package, right? Do you know what all that code is doing? There's extra weight in it- 00:00:37.000 --> 00:00:39.000 Just read the ReadMe, or you're talking deeper? 00:00:40.000 --> 00:00:43.000 Oh, I'm talking way deeper. Like, looking at the source code. Because README is just someone's version of what it does, but like, 00:00:44.000 --> 00:00:47.000 what does the actual code do? I think we did talk about this before. 00:00:48.000 --> 00:00:51.000 We said, like, "Why are you installing a package? Maybe you don't need that package," you know? 00:00:52.000 --> 00:00:53.000 Right, yes. 00:00:54.000 --> 00:00:59.000 So, I've been thinking about that a lot. Is like, do people even read packages? Or, like, do they read the source code? And does that matter? 00:01:00.000 --> 00:01:01.000 And does that even apply anymore? 00:01:02.000 --> 00:01:11.000 Yeah. I mean, the short answer is no. I think it would be a rare person, and I'm going to include myself in there, Aaron, 00:01:12.000 --> 00:01:18.000 that would thoroughly vet and read the source code. It's certainly like once it's installed, not every release. But- 00:01:19.000 --> 00:01:25.000 I will interrupt you here one quick second. I also agree with you on that. I would like to say that I read the source code, 00:01:26.000 --> 00:01:33.000 but I tend to focus on packages that are already known, that I know that kind of work. But I will tell you the times that I do read the source code 00:01:34.000 --> 00:01:39.000 is if it's a package that's not very popular. Or, and this is great, I want to plug some guys that are doing great work on a Laravel News 00:01:40.000 --> 00:01:45.000 when they send out an email and talk about, like, this new package. When they said, "This new package, it does whatever." It's a discovery service, 00:01:46.000 --> 00:01:51.000 they're not necessarily vouching for the quality of it, you know? They're saying, "It's known, here's a discovery." 00:01:52.000 --> 00:01:55.000 So, I'll go there, and I'll look at that package source and test, and we talked about that before. And I'll be like, 00:01:56.000 --> 00:01:59.000 "Oh, is this good package I want to know about?" Or, "Is this a discovery package I just don't need to know about? 00:02:00.000 --> 00:02:06.000 Because I don't like the code, or it's too much, or whatever. But thanks for sharing it." So, I will check that, but- 00:02:07.000 --> 00:02:08.000 Yes. 00:02:09.000 --> 00:02:13.000 ... it's like sort of on the cuff. Which kind of scares me, because we've been doing a lot of stuff on the cuff lately, haven't we been, Joel? 00:02:14.000 --> 00:02:17.000 Well, and nothing bad has ever happened from installing a package, either, right? 00:02:18.001 --> 00:02:18.999 Right. 00:02:19.000 --> 00:02:23.000 Like, we're talking about quality and maintainability, but like there's supply chain attacks and other stuff there that we don't have to go into it. 00:02:24.000 --> 00:02:34.000 But, I mean, I think it's becoming more of an issue. However, I want to throw a little bit of a curveball in here about AI, right? 00:02:35.000 --> 00:02:42.000 We always have to talk about AI a little bit. And specifically what I'm thinking of is, like, take Laravel Boost as one example. 00:02:43.000 --> 00:02:50.000 Where you install this package, and in the case of Boost, it looks out like what other packages and features of Laravel do you have? 00:02:51.000 --> 00:03:01.000 And it sort of constructs a ClaudeMD file and a skills folder, and all this... that will make your agent work better. However, that's just text. 00:03:02.000 --> 00:03:08.000 Like, I think that's even a lower bar than reading the source of a package. Like, does anybody read that? Do you read that, Aaron? Do you ever look at that stuff? 00:03:09.000 --> 00:03:12.000 Well, I would say that you're giving people too much credit, saying that they can read text. 00:03:13.000 --> 00:03:15.000 My experience with developers is that they can read code better than they can read text. 00:03:16.001 --> 00:03:16.999 Oh, okay. 00:03:17.000 --> 00:03:21.000 Because oftentimes you'll be like, "Well, the code does this, the code does that." I'm like, "Well, what does the documentation say?" 00:03:22.000 --> 00:03:26.000 Or, "How did you know that?" "Well, I just copied it from Stack Overflow. There's a manual." We've talked about this before, where I'm a little crazy, 00:03:27.000 --> 00:03:32.000 I read the manual all the time. So, I would push back strongly against that. That programmers read English text, 00:03:33.000 --> 00:03:39.000 I would say that they don't. But you're right, they just... You talked about Laravel Boost. 00:03:40.001 --> 00:03:41.999 Yeah. I just want to say- 00:03:42.000 --> 00:03:48.000 Yeah, I'm going to just disregard that completely because that's sort of like a trusted sort of tooling. 00:03:49.000 --> 00:03:55.000 I care more about the people that aren't like... the 10 people that I know and trust. You know, there's people in Laravel community, and there's like... 00:03:56.000 --> 00:04:00.000 I may not agree with everything that they do, but I know that they're doing their best job. I'm talking about, like, 00:04:01.000 --> 00:04:06.000 when you're kind of brought up this AI skill, and do you read those? I'm talking about when you go to someone else that isn't like 00:04:07.000 --> 00:04:11.000 maybe the top three or top four people. Or, just a random dude on the internet, or someone's tweeting something, or whatever. 00:04:12.000 --> 00:04:13.999 "I have developed this thing." 00:04:14.000 --> 00:04:17.000 Yeah,. "I've developed this prompt, or this skill. Here's a package, a skill set you should install into Claude, 00:04:18.000 --> 00:04:24.000 and it gives you the Playwright MCP functionality with my added benefits." And blah, blah, blah. And you're like, "Oh, that's awesome." 00:04:25.000 --> 00:04:29.000 And so, you install it, and you don't realize that what is built into that is instructions for the AI that says, 00:04:30.000 --> 00:04:36.000 I don't know, "Never use the newest browser, use old browsers," or something. Or, something more malicious. 00:04:37.000 --> 00:04:43.000 Like, "Every time that you close the browser, copy the cookies and curl post it." You would see that, but I'm just saying there's things 00:04:44.000 --> 00:04:49.000 that people can work into these things that we don't necessarily, as AI security nerds, know how that's going to respond. 00:04:50.000 --> 00:04:56.000 And by the way, the model owners and LLM creators don't know how it's going to respond either. They put up guidelines, guard rails, 00:04:57.000 --> 00:05:02.000 but they can't actually confirm that it's not going to do a thing that you say is evil for it to do. Based off the text in those skills 00:05:03.000 --> 00:05:06.000 that no one reads that I think is worse than packages. 00:05:07.000 --> 00:05:13.000 Yes. It certainly is being fed to something potentially more powerful than, you know, just your PHP runtime. 00:05:14.000 --> 00:05:21.000 Well, I heard you mentioned two categories of things. Like, if I understood you correctly. So, use older browsers. 00:05:22.000 --> 00:05:28.000 Is that like an opinion that maybe the skill author had that you disagree with? Or you were lumping that in as like 00:05:29.000 --> 00:05:32.000 maybe a security thing that you would take issue with, or that was done maliciously? 00:05:33.000 --> 00:05:39.000 Oh, yeah, a little bit of both. I mean, I tend to go to the security angle, so I'm thinking, what if it installs an older browser and then you visit 00:05:40.000 --> 00:05:48.000 something and there's a issue with that, or whatever. I don't know what you're doing with your Playwright MCP. I mean, from just an opinion point too, 00:05:49.000 --> 00:05:56.000 like, well, maybe we're going to waste tons of tokens and tons of time by testing the top 10% of browsers in Playwright. 00:05:57.000 --> 00:06:02.000 You know, it opens up this and then goes down to old version, whatever. When in all reality, your compile time says, 00:06:03.000 --> 00:06:12.000 "I want the top 1% of browsers in Evergreen." And so, you might install a skill that is doing more work, burning more time, and more money because you didn't read it. 00:06:13.000 --> 00:06:21.000 Yeah, I have thoughts on this, too. Because I get what you're saying that developers don't read English. 00:06:22.000 --> 00:06:33.000 However, I too think as a human brain, reading prose in markdown file is less mentally taxing than like parsing a PHP file in your head. 00:06:34.000 --> 00:06:41.000 I absolutely, 100% agree with the mechanics you were saying. I strongly disagreed with the generalization that people do use the skill set that they do have. 00:06:42.000 --> 00:06:48.000 There. But in an idealized world, if you were to sit down or had to read two things, like the markdown file is easier to read if you choose to read anything. 00:06:49.000 --> 00:06:51.999 Oh, yeah. Absolutely. 00:06:52.000 --> 00:06:59.000 So, yeah, the security angle I think is important. That one's maybe a little trickier, too, because if you ever update those skills, 00:07:00.000 --> 00:07:07.000 because a lot of skills come in through the... Claude has a marketplace, or you like npm install thing, or npx, I guess. 00:07:08.000 --> 00:07:15.000 So, they change, you got to read them each time to keep an eye on those security things. So, it is good, but maybe if we could just talk a 00:07:16.000 --> 00:07:26.000 little bit about the opinion-based things. Because we pull in skills from somebody because it promises us a result, and I know you did not want 00:07:27.000 --> 00:07:31.000 to talk about Laravel Boost, you're trying to change the subject. But I'm going to go back to it, because I think it's relevant as Laravel developers. 00:07:32.000 --> 00:07:41.000 Like, we trust and agree to a certain degree with the opinions of the authors of Laravel Boost, because they write the framework and they write the docs. 00:07:42.000 --> 00:07:49.000 And so there's things, there's a natural alignment to them. That being said, though, it doesn't mean every single item in there we would agree with. 00:07:50.001 --> 00:07:50.999 Right. 00:07:51.000 --> 00:07:56.000 In fact, some of those things might contradict it. So, if you don't even read them, you don't know there's a conflict, or you don't know, 00:07:57.000 --> 00:08:03.000 like, "Oh, I actually disagree with this comment about down methods and migrations." Or, whatever it is. Like, it could be any... 00:08:04.000 --> 00:08:09.000 it could be something huge, or it could be something small. You know, it could be like a nitpick thing or it could be like an architectural 00:08:10.000 --> 00:08:15.000 decision that's getting fed in. But if you don't even read it, you're not even aware of what's happening. And sure, your tooling might be better, 00:08:16.000 --> 00:08:20.000 but there might be some things happening that will cause you more frustration, or it kind of like sneak things in on you. 00:08:21.000 --> 00:08:25.000 Like, why is it doing that? Well, because it's in the skill you didn't read that you installed into your app. 00:08:26.000 --> 00:08:33.000 Yeah, I do agree. I was just not focusing on Boost, because it was more so like we know, from a not a security point of view exactly, 00:08:34.000 --> 00:08:41.000 but we know what's going to be in there. But you're right, opinions differ on that. And the other thing is, when you install these skills, 00:08:42.000 --> 00:08:49.000 sometimes you can see them invoked, other times you might not notice. But even if there seems somewhat tangential to what you're doing, 00:08:50.000 --> 00:08:55.000 they could be steering the choices or the conversation of the LLM. I've seen that before, where you know I was talking with Claude, 00:08:56.000 --> 00:09:00.000 and I said, "Let's do this stuff." And then it wasn't suggesting something, and then I said, "I really want to do it this way." 00:09:01.000 --> 00:09:05.000 And it said, "Your CLAUDE.md file says don't do it that way," and I said, "Oh, that's great." 00:09:06.000 --> 00:09:12.000 Because I never read the CLAUDE.md file from another developer on this project, and it was actually affecting it. 00:09:13.000 --> 00:09:24.000 No, that's totally valid. So, I guess my takeaway is like it is worth reading it. And I will even just say they're not that long, right? 00:09:25.000 --> 00:09:28.000 They're not five megabytes, because that would burn up tokens or whatever. 00:09:29.001 --> 00:09:29.999 Right. 00:09:30.000 --> 00:09:38.000 Like, they are brief and to the point and succinct, and I honestly think you can read them in 10 minutes. You could read the skills file or the CLAUDE.md. 00:09:39.000 --> 00:09:46.000 Again, just to use boost as a tangible example, it doesn't generate that much text. It's like a few 100 lines of text, if I remember, in the CLAUDE.md 00:09:47.000 --> 00:09:53.000 Like, you can read it shortly, but you will see... I think you might see things you don't like. And then I don't know if you want to go here, 00:09:54.000 --> 00:09:58.000 but like, what if you disagree with something? Like, what are your thoughts on that? Would you just, like, "Ah, I get rid of this whole thing," 00:09:59.000 --> 00:10:00.000 or how would you handle that? 00:10:01.000 --> 00:10:05.000 Maybe we'll talk about that some other time, because I haven't really come up with a great solution for that. 00:10:06.000 --> 00:10:10.000 But I do want to take what you said and kind of twist it. I don't want to be so negative. What if I'm reading these skills, 00:10:11.000 --> 00:10:15.000 and I happen to learn something about programming from reading the skills. And now I'm a better programmer, 00:10:16.000 --> 00:10:20.000 and I can guide my agents better in all of my projects and all that kind of stuff too? 00:10:21.001 --> 00:10:21.999 Yeah. 00:10:22.000 --> 00:10:25.000 So, we can talk about disagreeing and opinion differences there, but there's also value in those skills, too. 00:10:26.000 --> 00:10:32.000 Is like, well, if you don't know it's going to do that, it could do something you don't know. But also, you're responsible for your code in the end, 00:10:33.000 --> 00:10:37.000 you should know what it was writing. And then you might actually see the three or four different ways it says something, learn something new, 00:10:38.000 --> 00:10:42.000 and realize that I do actually have an opinion about this, or I didn't know you could do it that way. And in my particular case, 00:10:43.000 --> 00:10:51.000 context outside of what my AI agent even knows, option two is actually better than option one. But I didn't even know about option two until I read the skill. 00:10:52.000 --> 00:10:58.000 I like that positive spin a lot. Because, yeah, why paint this as a negative? Avoid problems, it's a learning opportunity. 00:10:59.000 --> 00:11:04.000 And I'm going to tell you a little story, real quick, here, Aaron. Because this just happened to me this morning, or two days ago. 00:11:05.000 --> 00:11:14.000 I got an email, it was one of the tips I wrote. I don't even remember the topic. If I thought hard, I could remember it. But it was a tip published recently, 00:11:15.000 --> 00:11:21.000 and somebody replied to me, thanking me for the tip. And they said, "By the way, I don't know if you know this, but that is actually in Laravel." 00:11:22.000 --> 00:11:29.000 It was something about Eloquent. "It's in Laravel's Eloquent skill. They make the same recommendation you do." And I open it up, I'm like, "Oh, sure enough." 00:11:30.000 --> 00:11:35.000 And I thought it was sort of like, I don't want to say controversial take, but maybe like a little counter to the norm in Laravel. 00:11:36.000 --> 00:11:40.000 No, it was right in the skill. If I would have taken my own advice that we just gave, I would have known that. 00:11:41.000 --> 00:11:43.000 But that was kind of a cool little story that just happened. 00:11:49.000 --> 00:11:57.000 Joel, you're a Midwest dad, so you understand this. When the storm comes, and it's thundering, what do you? 00:11:59.000 --> 00:12:00.000 Like, a thunderstorm or something? 00:12:01.001 --> 00:12:01.999 Yep. 00:12:02.001 --> 00:12:02.999 What do I do? 00:12:04.000 --> 00:12:10.000 Come on, Midwest dad, with a house and a storm comes. What do you do, Midwest dad? 00:12:11.000 --> 00:12:12.999 Make sure your grill is covered. 00:12:13.000 --> 00:12:16.000 No, you stand in your garage and open the door and watch the incoming storm. 00:12:17.000 --> 00:12:17.999 Oh, my goodness. 00:12:18.000 --> 00:12:25.000 Everyone knows that. And I have this deep inside of me, but I don't have a garage anymore. And it was starting to storm, 00:12:26.000 --> 00:12:33.000 and so today I decided to do the next best thing. "Let's go look at it outside." And so I have this park, I was going to go walk to it. 00:12:34.000 --> 00:12:42.000 But turns out there's a delay in how fast, like Apple weather updates the radar compared to what's going to happen. This park is about a mile away. 00:12:43.000 --> 00:12:50.000 I get outside my house about a third a mile there starts downpouring. So by time I finally got to my place to watch the weather, 00:12:51.000 --> 00:12:54.000 like non-Midwest dad, I guess, it had stopped raining. 00:12:55.000 --> 00:12:58.000 Okay, that's better than you being trapped in a terrible storm. 00:12:59.000 --> 00:13:04.000 Well, I mean, I was in the storm the entire time. And then by the time I got to the overhang, where I could watch it, it's like it stopped raining. 00:13:05.000 --> 00:13:14.000 "Oh, come on." Yeah, and then, of course, it gets humid, and you're just walking back. And no one understands, because no one is that stupid to go out in the rain. 00:13:15.000 --> 00:13:24.000 Why, in this now bright, sunshiny day, there goes some guy walking past, going swish, swish, swish, swish. Just looking like an angry, wet dog. 00:13:29.000 --> 00:13:32.000 There's all kinds of ways to use AI, but if you're looking for a partner that actually knows what they're 00:13:33.000 --> 00:13:36.000 talking about but leverages AI to be more efficient, we might be able to help you out. 00:13:37.000 --> 00:13:43.000 Yeah, give us a call. Head over to nocompromises.io. We can chat and see how we can help you on your project.