How Marketing Ruined Shift Left | Semgrep’s Tanya Janca

0:05Welcome to Dev Interrupted. I'm your host, Andrew Ziegler. And I'm your host, Ben Lloyd Pearson. This week, we're talking about Claude's new learning mode, Microsoft's original source code, and Shopify's controversial AI memo. Ben, what catches your attention? Well, because I've already had some conversations on social about this one, I want to talk about this Shopify memo because I think it actually is a pretty good story. So tell us about it. So the CEO of Shopify releases an internal memo saying that staffers, they need to prove that jobs can't be done by AI before asking for more headcount or more people to join their team.

0:43So this obviously has a variety of reactions from folks within Shopify, many of which have taken online to talk about it. And it feels like the whole tech industry is kind of spectating and commenting on this mandate that's happened within Shopify. My take on it is just looking at it, you know, it's a good idea, maybe taken to a bit of a functional extreme. How do you prove that a job can be done by AI. And if a job exists right now, but AI can do it in six months, what then? You know, how do you really justify the longevity of a headcount in that kind of space? And more importantly, after reading the memo, it kind of sparked a little bit of curiosity in me.

1:21I'm kind of wondering, like, what are the workflows at Shopify now that are performing this kind of AI powered work? Like, what kind of impact is that driving for them? I'd be curious to know. Yeah, absolutely. And, you know, I actually kind of agree with Toby Luke Case, the CEO of Shopify, with his general sentiment that AI really is fundamentally disrupting knowledge work. And, you know, like many skills, I think this is a muscle, like you need to develop it over time. You really need to work with it regularly in your workflows so that you normalize and habitualize the practice. And the harsh truth is that like, if you're not doing that today, then you're risking being replaced by others who are doing that.

1:59I'm not even just talking about your job. Like your competition is thinking about these types of things and they may already be taking action on it. But I also want to point out that this kind of highlights the disconnect between like executives and individual contributors that we talked about last week. How do you prove a negative? Like, how do you prove that AI can't do the job? You know, like Luque mentioned, they gave their employees a chat bot and, you know, we've discussed on multiple occasions how chat really is not the best interface for these AI. Yeah. And if that's all you're doing, then like, that's not enough.

2:31Like you need to be giving your employees a lot more support, a lot more tooling than that. And, you know, I'm not saying that Shopify is not because I just what I'm seeing from them, I actually think that they have done a pretty good job incorporating AI into their workflows. But it's got to be more than than chat bot. Yeah, I see we're speculating about it in the same way. So, you know, we'd love to have someone from Shopify maybe in the future come on and tell us about, hey, AI is transforming them. I think there's a story there for sure that we could all possibly learn from. Yeah, and I want to take a moment just real quick to plug a personality quiz we published around AI collaboration.

3:07So if you've ever wondered how effective have I been at adopting AI and using the new generation of tools, we have this really cool quiz that we'll put in the show notes that you can take. takes just a couple of minutes to find out. But we've already started to find some really interesting things from some of our early respondents on this. Specifically, 79 % of our respondents so far are still in the AI newbie category. So this is a category of people who have barely gotten AI into their workflows. And I think this is the norm. So don't feel like you're completely left behind if you haven't adopted AI.

3:42It's kind of interesting to see some of the adoption patterns that are emerging from this as well. Like the people who are being successful are finding some repeatable generation type activities, like generating code, generating docs, generating tests, like they're getting success with those before trying to move on to other things within the software delivery lifecycle. Because to be frank, we've seen quite a few of the categories within this quiz that nobody or practically nobody is using AI for it yet, even like in collaboration, like AI just hasn't even shown up in those parts of their workflow yet.

4:16So if you want to know where you stand on this journey, head over to those show notes, take that quiz. It's really fun. It can teach you something about yourself and help you understand where you are. Well, so what's our next story, Andrew? Oh, well, the next one I'm really excited to talk about. This is something that's really near and dear to me. And this is talking about how Anthropic is kind of turning the table on how students engage with AI and how it can unlock opportunities for learning. So Claude just rolled out a new learning mode that kind of put students in a position of doing the hard thinking.

4:47This goes back to how education has always worked is that it's always best if you get that personalized hands-on attention that's tailored for you and what you're interested in, that's always going to do better and engage a student more. So that really highlights this opportunity that's sitting right in front of us with AI. And, you know, as a former classroom teacher, I actually see a lot of potential and I'm really thrilled that major players in the AI space are taking this seriously and thinking about how this can transform education for our future. I think every student would benefit from it.

5:21And, you know, it even goes back to a talk that I heard last week. This was at Atlassian Team, which we're going to talk about a little more later. I listened to a talk by Sal Khan of Khan Academy and Ben Gomez, the SVP of learning and education at Google. So these are two great minds that have built education giants that help prepare people for the world and educate them and equip them with real skills. And they're seeing the value in using AI exactly like this to build products and to build educational experiences that speak to the student on their level. You know, if you have a student and you ask them, oh, you know, you want to be a doctor, here's why you should still care about literature.

6:01A great teacher can make those connections for the student and help them have a well-rounded education. Or, you know, you want to be a Formula One driver, here's why you should really care about physics. Like, what better way to engage a student and make them really care about the subject matter? yeah and i love i love how this story sort of flips the scripts on i think how a lot of people have normalized ai like today ai is used a lot or when it's used a lot of the times it just reinforces whatever you feed into it you know whatever you tell it to tell you it will tell you that and they sort of flip the script and use it to challenge you now which i think is a really critical way to use ai and i want to mention like this is really cool because it actually the geek in me loves this because it brings us like one step closer to the education system that they have in the book Ender's Game where everyone's got tablets with like AI that like adapts to them and like teaches them what they need to know individually.

6:58Like that's like that's brilliant to me. I love that. Yes, I thought the same exact thing actually. Just having that personalized attention, that personalized tutor is going to give you so much of a leg up in life. Yeah, and I feel like really what this is showing us is we've only scratched the surface on how AI is going to change the world around us. There's been a lot of disruptions from AI. We've seen this with how it's disrupting a lot of creative fields. But what happens when those people start getting access to this stuff that just revolutionizes how they can work? An education system where everyone's got a tutor in their pocket, that's an extraordinary thing to think about.

7:32And I think there's a lot of applications that we're going to see emerge, like therapy, personal health, nutrition. But I think really the thing to take away from this is that we hear a lot about how junior devs are maybe in a tough spot because AI is really more of a force multiplier for people who are experts, for people who have been around for a while. And if a junior dev is just sort of blindly using AI and not using it to challenge themselves, then there's a real risk that they're going to just not learn the right skills, the right knowledge to level up to that senior level. So yeah, I think it's just a great example of like, if you're using AI, especially if you're newer to the field that you're working in, challenge yourself with it.

8:10Don't just use it to move faster. Use it to get smarter as well. Yeah. Ben, have you ever heard of like rubber duck programming? Yeah, absolutely. Yeah. I think that is the real practice here that developers should be bringing to their tools, asking those questions along the way and just trying to reflect upon what they're putting in action and make sure that they understand what's going on. Yeah. Well, now your rubber deck speaks back to you with whatever personality you tell it to use. All right, cool. So what's our next story? Oh, yeah. So this is a fun one. Comes right from Bill Gates' blog.

8:42It's a little bit of a deep dive into Microsoft's history, looking at the original source code for, you know, the very first Microsoft to hit the market, the very first personal computer. This was actually a huge mathematical feat. It actually, for me, what I found so fascinating about this article, which you should go read, it literally has the source code in the article, How Cool Is That?, on a dot matrix simulated printout. What this really reminded me of is how much of the foundation in our field in technology and computer science has been laid by all these mathematical geniuses before us, and how there were these insurmountable problems early on in computer engineering that were solved by brilliant minds applying math and physics, sometimes even theoretical ones, in order to create a, basically trick a rock into thinking, like what an incredible achievement.

9:33And so this is a fun throwback on some of the ancient history around computing, personal computing. I really recommend folks check that one out. Yeah. Tricking a rock into thinking is one of my favorite metaphors of all time for computing. Yeah. Yeah. So I wanted to include this article just because it's such a cool piece of work. You know, there's ASCII art, there's dot matrix printer designs, there's these cool animations and of course there's some really great tech history so i definitely need to go check it out just to experience like this really cool like 50th anniversary content from microsoft so andrew i heard you were on the road last week how did that go oh yes dev interrupted is certainly going places last week i was at atlassian teams part of the press group there i got to go behind the scenes on all of their major announcements uh dev interrupted met with many leadership folks that were at Atlassian.

10:26They took really great care of our listeners and informing us about the big changes that are happening in the Atlassian ecosystem, including their release of Rovo. More importantly, what I learned while I was there is how quickly our field really is changing, but how collaboratively everyone is coming together to discuss real-world solutions. And Atlassian is no stranger to anybody. This is a household name for all engineers, has a huge impact on the engineering ecosystem and how we build our tools. So for Dev Interrupted to have the chance to go behind the scenes, understand how things are getting made and why those decisions are happening was really transformative.

11:05And it really speaks to the conversations that we're having here on the show every single week and why they're so important. Yeah, and I just want to point out that we're working with more companies like Atlassian, like AWS, to just get the word out about really cool engineering stuff that's happening out there. You know, if you're out there listening to this right now and you're like, I have a really cool engineering thing that I've done that I would love to share with the world. Dev Interrupted is here for you, like either on this podcast or in our Substack newsletter or even on social media, you know, so just reach out to us.

11:38But speaking of on the road, I will also be on the road next month. If you're going to be in Miami at the Code Remix Summit in early May or at the Developer Week Leadership Summit in San Francisco at the end of May, hit me up, let me know, and let's meet up and chat. I always love meeting people from the community. And, you know, Dev interrupted, we want to do as much of this as possible. So we're out there meeting new people, getting fresh ideas, getting new stories. So keep an eye out for us. We really want to use these opportunities to engage with our community. Oh, yes. We're going to be on the road and conference season is just picking up.

12:12And you may remember our recent guest as well, Adnan Ejaz from AWS. He came on the podcast and talked with us about how Amazon is working with agents, AI agents to transform workflows and applications. They sent us a special video message to you, the Dev Interrupted listeners, about changes coming from Amazon Q and opportunities for you to take advantage of in your own native language. And so if you're curious about what that means, definitely be sure to check out Dev Interrupted in places like LinkedIn. you'll be sure not to miss it. Because if you're just listening to this podcast, you're only getting a part of the story.

12:48You know, we're going on the road to conferences and we're posting lots of things on LinkedIn and covering all of these news topics on Substack as well. So like Ben said, please join our conversation, become part of the Dev Interrupted Network and come meet us. You know, we'd love to engage with you. Yeah, I almost feel like this podcast is like, it's like a filtered version of all the things that we want to talk about. We only have so much time. Or unfiltered, you know, they can decide. Yeah, maybe we just go back and forth between the two. I don't know. So tell us about our guest this week, Andrew.

13:20Oh, I'm excited. We're bringing cybersecurity expert Tanya Janka on the pod. Tanya's work makes our world safer, cooler, and more purple. Ready to move beyond Copilot? Join Linear B for a 35-minute workshop that explores how top engineering teams are transforming their workflows with agentic AI. We'll show you how to go from passive assistance to full AI orchestration, beyond the IDE and into real impact. Discover your place on the AI collaboration matrix and uncover the next initiative that could change how your team works. Don't miss your chance to learn from the leaders at the forefront of AI maturity.

13:59The workshop takes place on May 14th and 15th. Reserve your spot and step into the future of engineering. Today we're tackling one of the biggest gaps in software engineering, and that's security isn't a product, it's a practice. Yet too many teams treat security as a box to check or a tool to adopt instead of a skill set to build. And when it comes to securing software, most developers feel like they're playing catch up instead of setting the rules. And joining me today is Tanya Janka, aka SheHacksPurple. She's the best-selling author of Alice and Bob Learn Application Security, and most recently, Alice and Bob Learn Secure Coding.

14:42Over her 28-year IT career, Tanya has won countless awards, including OWASP Lifetime Distinguished Member and Hacker of the Year. She's spoken at conferences all over the world. Before her tech career, Tanya was also a musician and performer. But she's really done it all in the world of cyber, including counterterrorism and leading security for the 52nd Canadian general election. So we're really excited to have you today. Tanya, welcome to the show. Oh, my gosh. Thank you so much for having me, Andrew. I've been looking forward to this for months. We've been looking forward to having you here, tapping into some of your wisdom.

15:19You know, on Dev Interrupted, we talk a lot about the skills and the things that people need to be paying attention to right now in the world of tech. And nothing is more important than security. And I don't feel like security always gets as much attention and time from everyone as it needs. And I'm sure you as a security professional, security expert, very much feel that same way. So I want to start by kind of addressing a recent talk that you gave. This was about how shift left doesn't mean anything anymore. You know, what did shift left ever mean? So shift left was supposed to mean starting security earlier in the system development lifecycle.

15:56So when I was a dev, security was basically, I want to go live on Thursday. So Tuesday, I'm at like the CAD meeting. And then security says no. And I'm like, why? And they're like, you didn't do this thing we never told you you're supposed to do. and I'm like well my deadline's Thursday so I'm going live so I'll just try to do that between Tuesday and Thursday and you'll just get what I can do and they're like that's not good enough and then I would usually go to prod anyway then it was I ran this stupid tool because the tools were really stupid then in like 2011 and 2012 23rd they were not very mature so I ran this tool and found this one thing and I'm like I'll fix that one thing then it became and they would say that right when I wanted to go to prod right it was always at the end so then they're like oh we hired a pen tester and this person's gonna come in and tell your baby's super ugly and then we're gonna tell you you're a crappy dev you did a bad job and it's like well how was I supposed to do a And so when you look at the SDLC, like on a piece of paper, so assuming waterfall or water fail, depending upon how you pronounce it.

17:15But like, so not the eternity symbol for DevOps, but if you write it from, you know, left to right, like anglophones and francophones, et cetera, right. If you look at it earlier, so, you know, coding comes before release, but coding after, let's say, requirements gathering. so the further left on the page you are the earlier you are and so some marketing person or some person thought it would be smart to come up with shift left push left which I think is stupid I think it should have been let's start security earlier but that didn't catch on so they came up with this idea of shifting left and lots of marketing people were like yeah let's use that but what they used it for was if you buy our product you have shifted left if you stick our product in your ci the devs will magically fix everything you'll totally be secure and you don't have to do any other security don't worry no effort required not true um and so as a result a lot of security teams have been very like frustrated with tools they bought because they're like i was told i could just press three buttons and life would be grand and it turns out security is a lot harder than that.

18:28And then they're like, oh, and now we have a backlog with 40 ,000 random things that it found and no one has time to fix all of it. It's been ruined to not mean something anymore. But basically we did shift left as an industry. Like there's very few companies now that are just pen testing at the end. It is much, much more common to actually give developers some security tools, actually have some sort of security requirements, have some sort of architecture review. Those things are happening now. like they did not when I was a dev because I've been doing security. So I did security for a year and a half between 2007, 2008.

19:05Then I switched back to devving because counterterrorism, it's really scary. And I was like, I don't want a job that gives me nightmares all day, all night, not all day. And so then I switched back again in like 2014 full time. And like, I think 2013, I was part-time, like switching over. And now, like, it's just, it's improved a lot. It did help, but we're not done, Andrew. Yeah, and what you're describing too, the initial way that you encounter security, you go through security view, it's like an obstacle at the end. Like, you felt you were done, right? Well, I'm going to ship to prod. I'm going to push it.

19:40Like, I think it's good to go. My team thinks it's good to go. And then your act, like the security team feels like a blocker then at that point. So it's like it sets up this antagonistic relationship between the developers and the security team. And if the developer doesn't prioritize that, then they see it as like this extraneous step, as opposed to something that's core to building, you know, good usable software. So what you're highlighting is really interesting to me how it becomes like a marketing hype problem, a marketing situation where they take this concept and they move it. So when you're talking about how companies now, they do security practices earlier, like how do they actually move it earlier in the process without falling victim to like hype?

20:28Such a good question, Andrew. So I wrote two books essentially about this, right? Because I'm very, very excited about this. Because when I was the dev lead and it was just so abrasive and so crappy, it was such a crappy situation, I felt like of us not getting along. wrong so the way we can start earlier so first of all if we start earlier it's better we will save money we will have less conflict we will build better software period like hands down we really will and so what I like to do so I meet with companies and I have been doing this I guess since late 2018 through this company called IONS Research and then sometimes I do it just on the side but I meet with companies and we look at their program and I'm like so what are the strengths of your team.

21:13So if you have someone that's awesome at threat modeling, it makes sense that maybe you want to add that to your program. But if you have some like no one with any of those skills, that might be my last choice. Does that make sense? And so it's like, what are our strengths and what do we think we can support? And I try to start with the easiest things first. So as an example, so let's say you're building web apps and APIs, and then you're doing like one team's doing WebSockets. Cool. Okay. So from now on, I'm going to make a list of requirements for every new project that does those things, like security requirements.

21:48So you're going to build an API. Cool. We use this API gateway. These are the settings we expect. This is where you can find a document that will show you all those things. We expect this. We expect that. And it's super clear from the beginning. So they design it in from the beginning and they know how much work they need to do instead of us springing surprise work on them later, which no one likes. And so having a list of requirements and technical, concise, easy to understand, technical advice. So like you're going to do a WebSocket. Cool. Here's like some advice that we need you to follow when you build or maintain a WebSocket for us.

22:30starting with requirements to me is key because with those requirements you can say we expect you to scan it with these two tools and then remediate anything that's higher medium before you go to prod you can scan it in your ide you can scan it at the cli you can scan it when you check your code in you can scan it in the ci whatever it is that you want but when it gets to me it better have passed those things or i'm going to embarrass you and be like you're your baby's not that pretty right so then you've given them control because i am in control freak like i really am and i hated that i was not allowed the testing tools and i was like how am i supposed to pass if you haven't let me see the tool i need to run it myself fix everything then you may see it and they thought i was insane they're like why would we let you touch our tools And like they're forever.

23:24They're our tools. We're one team, dude. We are not enemies. We are on the same team. Trust me. Right. We're working towards the same end result. It's smart how you call out acknowledging what your team can do. What do you have the skill set for? And what do you have the bandwidth for? It goes back to a tool that maybe like you end up with a big backlog, like a pile of stuff to do instead of addressing them earlier in the process. That sounds to me like when you try to like start a habit and your habit is to just put everything in a bucket or in a list to deal with it later. How are you actually going to build a skill if you're not doing it every day, if you're not integrating into your life?

24:01If you want to work out, you know, if you want to get into shape, you know, you need to like do your little bit every day or as much as often as you can. You can't do it all at the end or you can't be like, oh, I'm going to do it later. It's going to go in my backlog. Right. So you're really calling out how it's about acknowledging and accepting where your team's at and what your skills are. It sounds like a bit kind of what you're keying us in on is almost like building like a little internal security library. Like we use WebSockets. These are the basic security things that we expect when people build WebSockets.

24:32And then that's where Shift to Left starts to actually happen within your organization. Because now your product managers, your team leads, they can design that into what they're building up front, right? Right. And if you're really lucky, I've done this with companies before, like where I worked full time. So it's like, here's our secure coding guideline. You're going to build a web app. I'm especially thinking of Java because I worked at this one place where we had 2000 Java apps. And so then it's like, here's, you know, number one, we want to validate all the inputs. And so then you could click that link.

25:06And then me and the devs had made a wiki page of like all different examples in Java of like this, how you validate a phone number. This is how you validate this. It's just like reuse the code. Do not write your own. This has been tested. Just use this. And we tried to do that for all of the examples we could. And so we made it so it was like really easy. It's like I'm designing a web app. You go here. I'm designing an API. Go there. And like I find you get so you know the expression like you get more bees with honey. I find you get more dabs with concise, short, actionable advice instead of like vague crap that sometimes I see, like, session IDs should be ephemeral.

25:45I don't know how to code that. Like, that means short-lived. So the first time I saw that, which was from a security team, I had to look up what ephemeral meant, and I'm like, short-lived. I can't code short-lived. What if I think short-lived is 20 days, and you think short-lived is 20 minutes? Totally. I'm like, I need you to be specific. And they're like, well, we don't know how long. And I'm like, well, then I guess this requirement doesn't exist. Go away. Right? Like, so if you can, so like whenever someone's like, we're going to write a policy and it's going to be like 400 pages, I'm like, cool, no one's going to read that.

26:18I'm going to write a summary that's half a page and be like, please, please read this half page. And then I would hold little workshops where I'd have as many people as I could convince come. And then I would teach them the thing. So I'm like, okay, so this is why APIs need protection. And like, here are the things we want you to do and why we want you to do them. This is how you do this. This is how you do that. And so that's actually how I got into training. It was like, I just kept doing talks at work all the time. And then I got hired to be the trainer at work. And then other people were like, could you like come train like where we work?