Episode 35: AI Hype vs. Reality: Rethinking Build vs. Buy

Open Source Reality Check

Send a text [https://www.buzzsprout.com/twilio/text_messages/1895117/open_sms] The dream of open source is freedom, speed, and shared progress—but the reality gets messy when it meets cloud-scale business and security. We explore how Docker kickstarted containers while Google’s Kubernetes turned them into an operational standard, and why that split shaped everything from engineering culture to company strategy. From there, we compare the cloud giants’ philosophies: Google’s foundation-first approach, Microsoft’s transformation from anti-OSS to stewarding GitHub and popularizing VS Code, and Amazon’s more transactional stance that sparked high-profile forks. The heart of the story is tension between ideals and incentives. Elastic’s licensing shift to block AWS’s managed service and Amazon’s OpenSearch fork set off years of license churn across databases, with Redis and others experimenting with “source-available” models. That turbulence pushed developers and CFOs into new due diligence: reading licenses, evaluating governance, and planning for change. It’s not just legal; it’s operational risk. We unpack what to look for in a healthy project and how to avoid license whiplash when a dependency changes course. Security adds another layer. The XZ Utils backdoor revealed how small packages can enable state-level infiltration, while malicious NPM uploads showed how easy it is to sneak malware into developer workflows. We revisit the infamous LeftPad collapse to explain dependency fragility and why reproducible builds, version pinning, artifact mirrors, and SCA tools are essential. Our playbook focuses on practical defenses—signed releases, SBOMs, automated alerts, and least-privilege build pipelines—so teams can keep the benefits of open source without gambling their stack. We close with a preview: AI is retracing open source’s path, from community energy to license debates and platform power. If you build in the cloud, this conversation offers grounded lessons on choosing, securing, and sustaining the code you don’t control. Enjoy the episode, then subscribe, share with a teammate, and leave a review with your biggest open source win—or worst dependency scare. What is Open Source? [https://www.proofpoint.com/us/threat-reference/open-source-software]Docker [https://www.docker.com/] Kubernetes [https://kubernetes.io/] Cloud Native Computing Foundation [https://www.cncf.io/] Open Source Initiative Approved Licenses [https://opensource.org/licenses] Google's Open Source Projects [https://opensource.google/projects] AWS Open Source Projects [https://aws.github.io/] The Hackers Book [https://en.wikipedia.org/wiki/Hackers:_Heroes_of_the_Computer_Revolution] Microsoft Visual Studio [https://code.visualstudio.com/] XZ Utils Backdoor [https://en.wikipedia.org/wiki/XZ_Utils_backdoor] Left Pad Incident [https://en.wikipedia.org/wiki/Npm_left-pad_incident]

Episode 36 - Open Source From Hackers to Kubernetes: How Open Source Evolved

Send a text [https://www.buzzsprout.com/twilio/text_messages/1895117/open_sms] Ever wonder how free software ended up running the world’s biggest clouds? We pull on a thread that starts with the hacker ethos—access, transparency, community—and follows it through OSCON memories, Docker’s breakout moment, and the quiet power shift that came with Kubernetes. From early research culture to the realities of running production systems, we map how open source moved from ideal to infrastructure and why today’s cloud thrives on community-built code. We look at why Docker’s elegant packaging changed developer workflows but didn’t solve the hardest problem: operating at scale. That’s where Google’s history with Borg mattered, and why Kubernetes arrived fully formed with controllers, declarative state, and battle-tested ideas. Crucially, governance moved to the CNCF, the Cloud Native Computing Foundation, letting every major cloud offer a managed Kubernetes service without locking users in. The result is a durable model for the cloud era: keep the core open and portable; offer the complicated parts—control planes, upgrades, reliability—as a managed service; and let teams build higher with confidence. If you care about how software is built, funded, and run at scale, press play. Links to topics from the show: Hackers [https://www.stevenlevy.com/hackers-heroes-of-the-computer-revolution] - By Steven Levy Docker [https://www.docker.com/] Kubernetes [https://kubernetes.io/] CNCF [https://www.cncf.io/] Open Container [https://opencontainers.org/] Podman [https://docs.podman.io/en/latest/] LinkedIn - Logan Gallagher [https://www.linkedin.com/in/logan-gallagher-9ba44895/] LinkedIn - Jon Gallagher [https://www.linkedin.com/in/jongallagher/]

Episode 35: AI Hype vs. Reality: Rethinking Build vs. Buy

Send a text [https://www.buzzsprout.com/twilio/text_messages/1895117/open_sms] In this episode, Jon and Logan  explore whether generative AI fundamentally changes the build versus buy decision for businesses considering software solutions. They analyze recent claims about AI-powered cost savings and examine the underlying principles that should guide technology decisions. * How Logan is using  AI in his common tasks  * Looking at recent claims from companies like Klarna about replacing SaaS with AI-built software * Revisiting the fundamental truth that Organizations must understand their core expertise when making build vs buy decisions * "Vibe coding" with AI creates maintenance problems as context for coding decisions is lost * Compliance, regulation, and data residency considerations become more complex with AI * Cloud infrastructure reliability remains a critical concern for AI-dependent systems * AI is most effective as an assistant for routine tasks rather than replacing human judgment * Traditional business frameworks still apply when evaluating technology investments Links: Jon Gallagher on LinkedIn [https://www.linkedin.com/in/jongallagher/] Logan Gallagher on LinkedIn [https://www.linkedin.com/in/logan-gallagher-9ba44895/] The auto parts software mentioned: Triad Systems [https://search.brave.com/search?q=triad+systems+livermore+ca&source=web&summary=1&conversation=cafe13368bcd31b659dc15] became Activant [https://en.wikipedia.org/wiki/Activant] Aaron Levie [https://www.linkedin.com/in/boxaaron/]- CEO of Box: Box becoming an AI-First Company [https://cloud.app.box.com/s/58461dcylju9f7g11c7f0getfnrvlwnc] Recommendations [https://www.linkedin.com/feed/update/urn:li:activity:7342954531099430914/] If you enjoyed this episode, please tweet us at @cloudoutloudpod or email us at cloudoutloud@ndhsw.com. We hope to see you again next week for another episode of Cloud Out Loud.

Episode 34 - AI Still Needs Humans in the Loop

Send a text [https://www.buzzsprout.com/twilio/text_messages/1895117/open_sms] When identical prompts yield different outputs and a request for "a cat running across the screen" generates four cylinders and a bobbing balloon, the non-deterministic nature of generative AI becomes impossible to ignore. Despite the power of these sophisticated models, we discovered that creating consistent, high-quality results demanded substantial human intervention – not less. Our journey moved from refining prompts to building extensive code example libraries, requiring the very software engineering expertise these systems supposedly reduce. This experience directly contradicts the popular "vibe programming" approach where developers mindlessly shuttle between AI suggestions and error messages. While this might suffice for weekend projects (as its originator noted), it produces unmaintainable spaghetti code lacking the architectural vision essential for professional software. Real engineering demands creating systems that scale, maintain, and transfer to other developers – not just code that temporarily functions. The lessons extend beyond development to any organization implementing AI in decision-making processes. These systems lack the contextual understanding to independently determine business priorities or handle nuanced human factors. The future belongs not to AI replacing humans, but to thoughtful partnerships harnessing each party's unique strengths. Ready to dive deeper into AI's practical realities? Listen now and join the conversation about how we can responsibly integrate these powerful tools while maintaining human oversight and expertise. Share your experiences with us at cloudoutloud@ndhsw.com or @CloudOutLoudPod. Jon Gallagher on LinkedIn [https://www.linkedin.com/in/jongallagher/] Logan Gallagher on LinkedIn [https://www.linkedin.com/in/logan-gallagher-9ba44895/] The Animation App on Github [https://github.com/gallaglo/gcp-demos-notes-and-tricks/tree/main/run/animation] Andrej Karpathy on vibe programming [https://x.com/karpathy/status/1886192184808149383] *Extra!* Andrej Karpathy on "Privacy Hygiene" - protecting yourself online now [https://karpathy.bearblog.dev/digital-hygiene/]

Episode 33 - Creating an Animation Application using AI

Send a text [https://www.buzzsprout.com/twilio/text_messages/1895117/open_sms] In this episode we try out what we've speculated AI, particularly GenAI is good for: expanding the capabilities of engineers as they create new applications. This application uses Google's Cloud Run [https://cloud.google.com/run?hl=en]  and Google Cloud Storage [https://cloud.google.com/storage?hl=en] to get user's specification of an animation, create the animation, then store and play the animation. This the link to the Github repo for the application [https://github.com/gallaglo/gcp-demos-notes-and-tricks/tree/main/run/animation]. The AI framework for the application is Google's Gemini [https://cloud.google.com/vertex-ai/generative-ai/docs/gemini-v2] and the program generates the animation is Blender [https://www.blender.org/]. The demo is programmed in Python and uses the LangChain framework [https://python.langchain.com/docs/introduction/] to leverage Large Language Models (LLMs) in the application