Apple HomeView | Build or Be Replaced

Today: Apple HomeView | Recreational Programming | Thunderbird for iOS Episode date: 2026-10-14.

Transcript

ERIK: Build or be replaced. JOSH: It's Wednesday, October 14th. This is Build or Be Replaced — powered by ScanBrief.dev. I'm Josh, here with Erik Anderson. ERIK: Today's theme is supply chains — code supply chains, hardware supply chains, all of it getting poked at the same time. JOSH: Stick around — Erik's got an AI pro tip at the end about when NOT to let an agent touch your git history. [pause] JOSH: Okay, quick headlines. First one — an OpenAI engineer got arrested for bugging an executive conference room. That's not a headline you see every day. ERIK: No, and it tells you something. The threat model for AI labs isn't just model theft anymore, it's physical. Somebody wanted to hear what's in that room badly enough to plant a device. [beat] JOSH: Next — Grace Hopper Celebration got cancelled this year. ERIK: That one stings. It's one of the bigger pipelines for women into tech, and losing a year of it doesn't just pause, it compounds. Hard to get that momentum back. JOSH: And this last one's actually kind of great — an MIT class project turned into an FDA-cleared treatment for tremors. ERIK: That's the dream outcome for any student project. Most of them die in a GitHub repo. This one made it through clinical trials and out the other side. [pause] JOSH: Alright, let's go deep. First one — Anthropic is redesigning source control. What does that even mean for a company like that? ERIK: So think about the scale. They've got agents writing code constantly now — not just engineers typing commits, but Claude instances opening PRs, running tests, merging things. Normal git workflows assume a human is the bottleneck on every change. That assumption breaks when you've got dozens of agents hitting the same repo. JOSH: Is that actually a problem you run into, or is this more theoretical for most people? ERIK: It's not theoretical for me. I've got Gandalf reviewing every PR before it merges, and we've run 2,295 auto-merge attempts since June. 1,507 of those merged clean. 788 got blocked. [beat] JOSH: Blocked — that sounds bad. ERIK: It's the opposite of bad. Zero of those 2,295 got escalated to me personally. Every single one that needed a human stop got stopped by the guardrail instead of waking me up. That's the whole point of the system. You don't want a frictionless merge pipeline, you want a pipeline with the right friction in the right spots. JOSH: So when Anthropic says they're redesigning source control, you think they're solving the same problem you already solved, just at way bigger scale. ERIK: Exactly. Git was built for humans reviewing humans. Once the committer on the other end is an agent, you need different primitives — provenance, intent, who approved what and why, not just a diff and a commit message. I'd bet they're building toward traceability more than speed. [pause] JOSH: Let's talk about the Ledger thing, because that one's scary. Spy chips in hardware wallets? ERIK: Yeah, this is the first confirmed supply chain hit on a major crypto hardware wallet. Units sold through a reseller in Southeast Asia had an implant soldered in that siphoned private keys straight off the device. JOSH: Wait, really — soldered onto the actual board? ERIK: Soldered on, sitting there undetected until somebody's funds moved. And the device still looked legitimate, still passed casual inspection. That's what makes hardware supply chain attacks worse than software ones — you can't patch a chip. JOSH: How do you even defend against that as a regular person? ERIK: Buy direct from the manufacturer, never a reseller, and verify the tamper seals before you ever plug it in. I've held Bitcoin since 2014, run my own full node specifically so I'm not trusting someone else's infrastructure. The same logic applies to hardware — the fewer hands it passes through before it reaches you, the fewer chances somebody had to modify it. JOSH: Does this change anything about how you think about your own infrastructure? You've got, what, 144 services running on the prod server right now. ERIK: It does. Software supply chain I can audit — I know what's in every container, every dependency gets reviewed before it ships through the pipeline. But it's a reminder that the attack surface isn't just code. If I was shipping physical hardware to clients, I'd be thinking about chain of custody the same way Ledger has to now. [pause] JOSH: Last deep dive — Gemini 4 Argon. This is the one that helped the Chrome team pull apart a six-million-line legacy module. ERIK: Right, and the number that gets me isn't the six million lines, it's the forty million line codebase it's sitting inside. That refactor, decoupling core page handling so a tab can migrate into a side panel or a floating window, that's the kind of change that takes a senior team months normally. Argon got it down to weeks. JOSH: What does "weeks instead of months" actually look like day to day? Is it just faster typing? ERIK: No, it's parallelism. A human team has to sequence the work because everybody's stepping on the same files. An agent can hold way more of that six-million-line module in context at once and make consistent changes across hundreds of files simultaneously. I see the same pattern on a much smaller scale with PrimeRouter — when I need a change to touch the routing config and the chain definitions and the tests all at once, the win isn't speed of typing, it's not losing consistency across files a human would lose track of by file forty. JOSH: Is there a risk there? Moving that fast through a forty-million-line codebase sounds like it could break something quietly. ERIK: Huge risk, which is why the review layer matters more as the generation layer gets faster. I don't let any agent touch a protected chain or a core routing path without an explicit approval step, no matter how confident it looks. The faster the refactor engine gets, the more disciplined the review gate has to be, or you're just shipping bugs at a higher velocity. JOSH: So the real story isn't "AI refactored Chrome," it's "AI refactored Chrome and somebody still had to gate every piece of it." ERIK: That's the story every time. ScanBrief scored 99 items overnight across 56 sources, and half the headlines in this space are "AI did a thing." The interesting half is always what had to be true around it for that thing not to blow up. [pause] ERIK: This episode is sponsored by Prime Automation Solutions. If you're still doing it manually, we automate it. Also, special on a website — $250. primeautomationsolutions.com [pause] JOSH: Alright, what's the AI pro tip today? ERIK: Never let an agent run a force push or rewrite history on a shared branch on its own authority. I had guardrails before this was even a question for me, because the failure mode isn't a bad line of code, it's losing other people's work in one command. If you've got an agent operating in your repo, give it merge and commit, but history rewrites stay a human-approved action, every time. JOSH: That's your tip. Use it. [beat] ERIK: If you're building toward financial independence through automation, my first book walks through the whole path. Free chapter at erikandersonbook.com. [pause] JOSH: One more thing — we started a Discord for builders. If you're shipping AI, automation, or anything that makes a human obsolete — come hang out. Link at buildorbereplaced.dev. ERIK: Post what you built. We'll post what we're building. Real wins, real builds, no fluff. [pause] ERIK: Build or be replaced. JOSH: If you want these signals in your inbox every morning, scanbrief.dev. See you tomorrow.