The move came after 404 Media published an investigation into how Proton CEO Andy Yen was aggressively pushing AI across Proton despite security concerns and the culture of fear he has created.
In one exchange, an employee in the company’s security Slack channel urged Proton to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.” Yen added, “stop lovingly handcrafting all our code and use AI more.”
His words are aggressively out of touch, but I will say that I agree somewhat. I tried going back to handcrafting code for a bit and it really does feel slow. Like, “absolutely no way to compete in the current market” slow.
Speed is not a good quantifier for industry success. Speed to market might get you some initial customers, but speed alone won’t keep them. If your product is junky, slow, and insecure you are going to lose those customers you had, and potentially open yourself up to lawsuits in the process.
The things that matter more to long term success and sustainability are all the things AI is not.
I never said speed was all that mattered. But from my experience, and my other friends in the industry, it is possible to achieve speed while maintaining quality. security, and maintainability. Because these are all things that the AI can look for too. Just look at how many vulnerabilities AI is finding nowadays. Just like any other product manager, you can bring up concerns, ask the AI to look into them, and validate the AI’s claims. Just like you would manage a team of engineers. Which is of course still faster than writing everything yourself.
If all you ask the AI to do is produce lines of code, that’s all it will do. But AI workflows can be far more complex than that.
The quote is talking about how the CEO is scoffing at an engineer asking for a few days for pentesting. None of that has to do with using or not using AI for coding. Doesn’t matter who wrote the code, the management of a privacy first company looking to cut corners on testing for buggy code is a no no for their customers.
Slow has nothing to do with pen testing or not. Pen testing is how you validate that the code is secure, AI or no. This is showing a shocking lack of care about security for a company pretending to offer a secure product.
Without the entire slack exchange, it’s not clear whether Andy Yen was responding exclusively to the call for pentesting, or towards broader comments about AI code.
Look I’ll be honest, a CEO telling his workers their (valid) opinions are bullshit and looser thinking is absolutely unacceptable, even putting the context of security (or lack thereof) aside. If you refuse to listen to your engineers as a leadership, you have failed miserably.
Huh? The frontier model companies aren’t operating at a profit but all the major enterprise tech companies (Google, Microsoft, Salesforce, Amazon, etc) are using huge amounts of AI in the SDLC and beyond and certainly are operating at a profit…
I’m not sure what you are trying to say, what difference does it make if the users of a product are profitable when the creator of said product isn’t, the users of AI make their money on a diversified portfolio of products, the AI companies are making no profits right now as the subscription prices they are charging are at a loss to gain market share, if they don’t find a sustainable profit margin over time they will have to shut down or increase the cost of the subscription so only a limited number of companies and individuals will be able to afford it. Either way the gushing AI inference taps will stop leaking so freely at some point.
“skill issue” comments are rarely productive. I have many friends that also work in the industry that feel the same, even if they are against AI. I trust their opinions (and my own of course) over yours.
Yikes, this Yen guy seems really charming
His words are aggressively out of touch, but I will say that I agree somewhat. I tried going back to handcrafting code for a bit and it really does feel slow. Like, “absolutely no way to compete in the current market” slow.
My job is not to be fast. This expectation of development speed is bosses not understanding why they hire specialists.
I code, make sure it works, is secure and maintainable. That’s how I own my work.
Speed is not a good quantifier for industry success. Speed to market might get you some initial customers, but speed alone won’t keep them. If your product is junky, slow, and insecure you are going to lose those customers you had, and potentially open yourself up to lawsuits in the process.
The things that matter more to long term success and sustainability are all the things AI is not.
I never said speed was all that mattered. But from my experience, and my other friends in the industry, it is possible to achieve speed while maintaining quality. security, and maintainability. Because these are all things that the AI can look for too. Just look at how many vulnerabilities AI is finding nowadays. Just like any other product manager, you can bring up concerns, ask the AI to look into them, and validate the AI’s claims. Just like you would manage a team of engineers. Which is of course still faster than writing everything yourself.
If all you ask the AI to do is produce lines of code, that’s all it will do. But AI workflows can be far more complex than that.
The quote is talking about how the CEO is scoffing at an engineer asking for a few days for pentesting. None of that has to do with using or not using AI for coding. Doesn’t matter who wrote the code, the management of a privacy first company looking to cut corners on testing for buggy code is a no no for their customers.
Slow has nothing to do with pen testing or not. Pen testing is how you validate that the code is secure, AI or no. This is showing a shocking lack of care about security for a company pretending to offer a secure product.
Best of all, that really is something LLMs are quite good at too. Aikido has a feature where you whitebox pentest your entire application.
Without the entire slack exchange, it’s not clear whether Andy Yen was responding exclusively to the call for pentesting, or towards broader comments about AI code.
Look I’ll be honest, a CEO telling his workers their (valid) opinions are bullshit and looser thinking is absolutely unacceptable, even putting the context of security (or lack thereof) aside. If you refuse to listen to your engineers as a leadership, you have failed miserably.
It only feels slow when everyone is forced to use AI, none of these companies have proven to operate at a profit yet
Huh? The frontier model companies aren’t operating at a profit but all the major enterprise tech companies (Google, Microsoft, Salesforce, Amazon, etc) are using huge amounts of AI in the SDLC and beyond and certainly are operating at a profit…
They’re operating at a profit because of their large legacy products, not because of their new stuff.
Example A: Google
Did you even see their earnings miss and what they attributed it to?
I’m not sure what you are trying to say, what difference does it make if the users of a product are profitable when the creator of said product isn’t, the users of AI make their money on a diversified portfolio of products, the AI companies are making no profits right now as the subscription prices they are charging are at a loss to gain market share, if they don’t find a sustainable profit margin over time they will have to shut down or increase the cost of the subscription so only a limited number of companies and individuals will be able to afford it. Either way the gushing AI inference taps will stop leaking so freely at some point.
sounds like a “you” problem
“skill issue” comments are rarely productive. I have many friends that also work in the industry that feel the same, even if they are against AI. I trust their opinions (and my own of course) over yours.