Transcript: JWTs and AI - David Sanders

I'm Will Vincent, joined by Carlton Gibson.

Hi, Carlton.

Hi, David.

Hi guys, thanks for having me.

What kind of thanks for coming on.

So we want to ask you about that and all your other work.

But first, what's your backstory?

How'd you get into programming and specifically Python Django?

Yeah, I was I was trying to think about how I would come about this question as I was showering the morning.

Um let's see, I think I probably got into programming for uh similar reasons uh to a lot of other sort of nerdy kids growing up in the 90s.

Um and you know, I was like I liked video games and things like that.

And uh but yeah, it also just so happened that I went to a high school which had some uh classes for that, which I think was not super common in the 90s.

Um I mean it's

Even in a college town.

I mean so it's pretty early on, and so you know, this is when computers were just starting to become sort of household fixtures and uh and the internet was

We had email.

I remember in my high school, we were very proud of that, like late 90s.

But it sort of stopped at email.

No programming classes.

That's good.

That's like a good litmus litmus test for what we're talking about here, because email had just showed up and and it's uh you know, to the average person in its probably most early form.

And yeah, I remember my middle school actually had email for like it allowed you to sign up for a Unix account, and this is in like '93 or something.

And that was in Boulder, by the way, where I'm

Yeah.

Well, well, there's probably some similarities because I'm from basically Dartmouth.

Um, and so Dartmouth had its own homegrown email system way back in the day.

Yeah, and I think I remember the high school system.

Yeah, they and then the and they you know created the term AI at some conference in the 50s.

Um, but they the high school's email system was um based on Dartmouth's, which was called Blitz, I believe.

So I think you could, you know, you could AOL, you could like, you know, CDs were flying around, you could connect that way, but to have a you know high school run email system in the mid-90s was unusual, but probably not atypical for high schools in you know university towns where you had some degree of knowledge.

But I guess later I found out that the server was actually at CU or University of Colorado at Boulder.

So it was actually located there, and I assume it was part of you know uh the technology departments or the engineering school or something.

So yeah, so so that was lucky, and I think that was a big reason why they were programming classes and why um why I was able to you know pursue that interest um early on.

I was like, uh, what's what's this?

How do I, you know, how do I do anything here?

And I didn't actually, I started on a Macintosh machine, and this is like way before Macs were like even really a thing.

I mean, they were, but they were definitely kind of less common.

So the old what Mac 2s, that was what we had.

I remember that.

Yeah.

But for a while it was, I mean, because I remember my middle school, we had a computer class where we learned how to type, and someone uh told me if if you just took the test in the beginning, that was an option.

So I did that.

So I remember just playing Oregon Trail and like Manhole for a semester, which was pretty fun.

Uh so we actually had a color monitor, which was like 13 inches or something.

I played around that yeah, yeah, and I it was middle school for me, so 93, 94.

Yeah, that was

Sorry, Carlton.

Um no no no,

I'm loving it.

Yeah, I'm gonna do that.

So I've been I so I download so I downloaded it and I've been playing it, and it's still so good.

And then my seven-year-old daughter, I was feeling kind of good that I remembered a couple things, but it's you gotta think about it, she's just like touching stuff.

She zipped through like more than I did.

She was like three times as good as I am.

Yeah.

So it's sort of humbling.

Mist is such

And of course, it was just pre-rendered videos essentially.

And and it was, yeah, it was basically written in PowerPoint.

You know, that it was this thing called a hyper card.

Um, and so you know, if PowerPoint had a scripting language, which maybe it does, but I don't think that's really a selling point of it.

That's that's how you could orient yourself in this conversation.

Like this video game was like very popular and was written in PowerPoint essentially, and just embedded videos in PowerPoint slides.

But sorry, last thing on this, because I've been um so there's another game, Riven, which came after in high school, 97, 98, yeah.

And I haven't gotten that yet on the iPad, but I'm going to.

But I remember playing that.

There's like four discs on it, and you have to go between worlds.

And so every time I had to move, I had to like swap discs.

And besides the fact it was like way harder and I had to cheat to finish it, I remember just endlessly swapping discs, which was super frustrating.

So I'm excited to not have to do that on the iPad coming up soon.

I I mean this this is in a way kind of the story of how I got into programming.

Like I just loved things like this when I was a kid, and probably a little bit before a lot of other people took interest in these kind of things, and um and then I was lucky enough to have access to educational resources, and and so I just kind of went from there.

And in school, I sort of did engineering, I kind of didn't, I was kind of half did it.

Um, but then

When did you get into the Python world?

Um so I basically ended up getting a music degree.

Uh that's my formal education.

So that's kind of an interesting tidbit about me, which is something I choose at now now.

I've decided to re broadcast that to the world, it seems.

So um it's not something I

I mean, where I am in in Boston, there's there's Berkeley School of Music, and a lot of those a lot of the best programmers in Boston are former Berkeley musicians who, you know, it's hard to make a living, but they are very used to dedicated practice.

Um anyway, so let's see.

Uh where was I going with this?

I feel like

So you studied music in school.

And so so then I can't, I was coming out of that degree.

I just decided to um, you know, just get back into technology for obvious reasons because it's it's hard to make it in as a musician.

Um, and so some of the first jobs I was finding at the time were like PHP sort of web app type stuff.

Um, and that was how I kind of reintroduced myself into the tech world.

And I I had had even a few sort of software jobs before finishing school, um, but that was sort of a different era of software, and so yeah, as I sort of got back into the tech world, I think that was like 2008 or nine, it was like right about when smartphones had happened and um you know social media was starting to kick off a second sort of dot-com boom essentially.

And so there were lots of kind of uh web app type, but there was a lot of web app work available.

So getting into PHP and that transitioned into my next job uh doing Python and Django, and it was all in the vein of like web application work.

Um and yeah, so I that was when I joined a company called Fusion Box in Denver, uh which I believe is still around.

Um and they were a Python shop, and they had a number of really talented Python developers doing Django development, and that was where I got into it.

And that I think that was about 2011 or so.

Um what would you say, Carlton?

I mean, I know it's been out for a while, but it wasn't that's

Um 2006, doing PHP, MySQL, and then I don't know, 2007, two that out, found found Python, and you know, I I went to a web conference, uh a tech conference that's called Future Web Apps, and everyone was talking about Django, Django, Django, this thing that had been released now at home, typed in.

It's like the web framework for perfectionists with a deadline, right?

That's me.

Yeah, you know, it wasn't just Django, it was Python as well, and it was like, ah, brilliant.

So, and then yeah, writing writing web apps along with mobile apps and that kind of same time, exactly that same sort of timeline, same time zone.

It's all about around the Django 1.0, 1.1 versions, that kind of thing.

That was around that was in the 1.0 days.

And I can't remember what version I it was like 1.3 or something, I think, when I started working on it.

Um anyway, yeah, that was how I got started.

I mean, for me, I didn't really start programming until 2013.

And then it was I was in San Francisco at startups and it was like Rails or Django, and I think Django was the less popular choice, and I'm sort of a um iconoc uh what's the word?

Not iconoclast.

Um what's the word, Carlton?

No.

Um and I like the look of Python, so I jumped on the show.

React, JavaScript, Rails.

Um and then and everything was Rails.

I mean, we were right, we were right next to Twitter, Square, Stripe.

So yeah, it was all Rails.

Boot camps had just started, and nobody was really doing um Python or Django.

Right.

He was the guy who did hunch up.

Back bunching.

Yeah, so that's what we were using.

Well, it had all the great helper functions that kind of made their way into JavaScript itself.

And did I say his name correctly, Jeremy Ashkenaz?

It's been so long since I thought of this.

He's done some other.

Seemed like a very prolific technologist.

So those people.

I want to get to um your JWT package.

Like, did you start working on APIs with Django?

Was it server-side?

Like, what was the progression if you recall?

Um because right, when I first started using Django, I was doing a lot of uh what would you call it?

Um traditional sort of server-side rendered web apps.

And of course, eventually the industry transitioned more towards just APIs interacting with uh you know front-end clients essentially uh written in JavaScript.

And so the eventually I went to work for one of our clients when I worked at Fusion Box, which is specialized bicycles, which is kind of a funny like you know, place to find yourself as a software developer.

Some might guess.

Um because you know, specialized obviously, and and I'm talking about the you know, if you know bicycle brands, it's the specialized you're thinking of uh in the United States.

There's a kind of uh bike brand that's that's kind of on the same tier as tech or trek, rather.

Um and yeah, that's specialized.

So they had a number of kind of uh data collection services essentially that they needed to be written in-house.

Um, and that's what I was working on when I was there, and those were supporting all these kind of like um they were doing a lot of like body metric collection with like these little digital measurement devices they were making, and and so I was writing the APIs that would receive data from those devices.

Do they have like power um meters on the um drivetrain?

Um, and actually it was really around the same time as Strava, but but our stuff was more just kind of like data collection, and so we had a few devices that we made to sort of uh give to people who were running specialized shops, and they could use it to like measure measure people's bodies to like suggest products to them and things like that.

So um anyway, yeah.

So I was writing a lot of APIs um, and we uh like I said, this specialized had been a client of Fusion Box, and um and so they had already been contracting with us to have some developer, some Django uh apps that we were writing, and so we had we had a few more kind of like um traditional apps that were server-side rendered, and then we were starting to do some kind of JavaScript front-end

stuff with them, and so it was kind of a natural transition to just continue using Django and um yeah, so

What was the time frame?

So it was fairly early

The rest framework version three Kickstarter was in 2014.

So there must have been 2000.

I I was using REST Framework around version one, version two in like 2011, 2012.

And it was kind of competing with TastyPie.

And I do remember that it was it seemed a little more newish and maybe sort of unproven.

Again, Tom might correct us, but uh um but it did seem like I just sort of caught I got the impression that that it just seemed a little more kind of clearly organized and things like that, and um, and so I just we just made a call to use REST Framework for the stuff we needed that kind of thing for.

And then I just continued to use it, you know, at at jobs after that.

So um, or sorry, we as in uh fusion box guys decided to use REST framework.

So so yeah, we were using that for our specialized work, and eventually we just needed a way to sort of do sort of single sign-on-e like um mobile mobile client off uh stuff, and JWTs were again from my point of view, seeming kind of like they were just showing up or starting to be used.

Um and this was probably this was like I don't know, 2013 or 14 around that time, maybe a little later, 16 or 17.

I assume there was, I mean, his was still you know more maintained.

Um so do you recall you know why why create a a new one?

As far as I remember, so I was looking around for like what um what was available to use, and of course I ran across Jose's package, and I remember thinking that it seemed possible that it was maybe starting to be maintained less often, um, or that was the general pulse I got on it when I was looking into it at the time, and so I I started poking around under the hood with the package, and it seemed to me like there was there were really just a few classes he had

written which um which were really kind of uh driving the package, and I kind of thought, well, this stuff is there's just a little bit here, and so I think I will just take what I need from this and start to just make something.

It was almost like just sort of an academic exercise, too.

I was kind of like, how would I just sort of factor out the essential core of this and make my own version of it and do it in as few lines of code as possible?

And um, and so I started doing that, and it it just kind of came together pretty quickly.

And so I just decided to go with my own sort of version of it.

Um and of course, eventually I got in touch with him and I sort of let him know that I had done this, and he was very encouraging because it he was, I think at the time already starting to feel like it was sort of the package was going into disrepair a little bit, and that it was maybe useful for someone to come along and um just sort of take up the reins or kind of reinvent it or something like that.

And so it seemed like the timing was good there because yeah, I just I I had a need for that kind of thing.

I happened to notice that it seemed like maybe there there could be another sort of a reworking of it.

Um so yeah, that's how that's how that happened.

And yeah, so we just started

And um and so I just happened to do that with Jose's thing, and I also am just kind of a perfectionist, somewhat, and so I just thought, well, if I were to make this something that people wanted to use, then I might as well just kind of like try to do it cleanly and sort of pretend like I'm making an open source package here that people might want to use.

And uh

yeah, was it your first interesting open source package that you'd done for Django, anyways?

Like I had done a few little sort of things that were on my GitHub.

There was sort of like a smorgasbord of just sort of like half-baked things in my GitHub account.

Um, but then I think I think the real critical like difference was that yeah, it was just a time in my career where I just I just had enough experience to know how to put something together that's reasonably coherent.

And I also had I happened to have enough time and a reason to do it.

And um I also

Yeah, I didn't know what I was getting into, and so and I also reached out to Jose and and also Tom Christie because I had sort of borrowed components of their project to make this thing, and there were enough differences that it didn't feel like just a fork that I could just or like a something I could make a PR for.

And so I felt obligated to sort of notify them that I had done this, and uh, or in particular Jose.

And I was he he was very receptive and positive about it, and then also I reached out to Tom and I said, Okay, I think in like I don't know, whatever chat channel is linked from the REST framework website, and I told him that I had done this thing, and uh I wondered if he wouldn't mind adding a link in the Rest Framework documentation to it.

And that was, I think, when it really kind of took off, and the the star count started just like exponentiating on GitHub, you know.

And that was a big goal for me.

So I was striving for that.

And yeah, yeah,

I'll link to the the notes in um DjangoCon 2018.

I did a talk on auth with Django S framework and um actually where I met Carlton, and I remember asking Jose, I was like, Hey, I'm doing this talk.

Um, is your package still active?

You know, should I I've been using yours, but there's this simple JWT one.

And he was like, Oh no, no, no, use use, you know, use the other one, use yours.

Oh wow, that

Man, there must be like a sort of constellation of activity in the community.

I'm just completely unaware of because I I don't really make the rounds of conferences very much.

I mean, and I mean this podcast came out about because going to one, I was like, oh, there's people talking about Django.

Like, I never get that my normal life, so I wanted to share it.

Um, but he was very I mean, I mean we had Jose on the podcast too.

There's a past episode, but um yeah, he was anyway, it's just he was very much like, oh yeah, like I use use David's.

So I did, so it's in there.

Um and there was a fair number of links that came from like a screencast somebody did where they were like, this is how you do JWT with Django, like use this package.

Oh and

Uh so they they get a lot of clicks.

Uh like for example, that talk from 2018 is the has the most views of any talk from 2018.

So I think part of it I was like thinking like, well, I I did a good job, but then I I did a different talk in 2019, and I'm just like bottom of the barrel, and the top talk is another one on Django Rest framework.

So it's it's very much like, yeah, people just want to learn about that.

Um because I think also Django Knots, a lot of them don't know Django Rest framework, or they don't like I I I have a book on it, and I kind of thought that'd be my most popular book, actually, and it's by far my least popular book.

Because and I think it's because professional Django developers basically only write back end APIs if you're at an agency or at a reasonably sized company.

But I think when you're learning or if you want to do a smaller project, generally you're just in the server-side world because it's too much to do Django plus, you know, whatever jobs your framework of the week.

So so I've found that interest I've I've tried to communicate that, and I think I'm still not quite getting that across to people.

They just don't if they're learning on their own, they just don't understand why they would really use Django Rest framework um or they don't have teammates to do it.

So anyways, side note, I I yeah, I so I so actually uh so I initially was like Django for beginners, Django for APIs, and then this prose book, and it just turns out that APIs is actually like the last one people read.

And it's really only in the context of once they get their first team job that they do it because I mean because writing an API is like what's the point as for yourself, unless and then and then you gotta go learn JavaScript and

I think you were hinting at it's probably a big ask to really sort of expect that somebody just getting into that stuff would be able to learn all the ins and outs and quirks of JavaScript and whatever you need to sort of get up and running with um you know with that kind of stuff and uh and do that in addition to learning about Python and you know server-side development and all that kind of thing.

So yeah.

Well, and specifically authentication, I found, you know, once once I internalized what a serializer does, authentication is the part where, and I think this is still the case from um from people who contact me, that's the part where people go, What?

Because you know, you don't really have to understand sessions and session um authentication with Django, it just kind of works.

But then the official docs, I think, still list four.

There's four built-in options, and then there's just like a dozen third-party packages.

And I I don't think it's that much clearer to people what kind of uh what best to do.

I mean, I think there is a sense of JWTs are a good idea, but then even there's multiple ways to do it.

Um so that's the confusion point for people once they get past serializers, is like I didn't know auth could be so hard.

Yeah.

Or how do you think about that?

Do you um how how do you think about that?

Clearly you're at the package so you use them.

But if someone came to you and are there cases where you wouldn't where you wouldn't recommend using it?

Uh like I said we were talking about doing single sign-on and so I think I was finding information about JWTs because there's this idea that you could just have the same verifying key across different services and so you only really need to sign on with the service that has the sign-in key and so they can sort of function as a single sign-on system in that way.

But the other need I had was that uh that we were gonna write an API for a mobile client and I think we were working with some contractors from a different agency to do this and those guys were just comfortable using JWTs because I think they had gained enough of a footing in that sort of area of tech that they were already being used for that kind of thing.

So yeah so I think those were a couple of the reasons I started to use them I mean as far as like I still think it's interesting how you can just sort of avoid database hits um to authenticate requests and that's kind of like uh one of the attractive things about JWTs you know because like you don't have to go query the database to find a session record like you can just verify the signature and that's all you need and that's like a that

's a relatively inexpensive operation compared with a trip to and from the database.

So if you're really trying to go after performance and a service then I feel that that could be a consideration.

And I feel like I've tried to sort of emphasize that with that package.

I mean I feel like there are other ways that that tends to get broken like if you want to implement blacklists you know token blacklists and things like that then you just kind of have to do a database query anyway and so you've kind of thrown that out the window or I don't know I mean maybe there are ways you could optimize that but yeah

But um but you still have to sort of open up a socket to your caching server and you can't just do it completely within the the confines of the uh gunacorn process or something you know like you have to do some IO in order to serve that request um but I guess you're doing that already anyway you're doing IO with the uh the web server anyway you know what I'm saying like yeah there there are some considerations along those lines um and

so I've tried to sort of remind people of that because a lot of people come in the issues of the JWT um package and they're like well why don't you just do blacklist by default or this or that and I'm kind of like well yeah like ideally you wouldn't have to do that kind of thing if you don't want to and um yeah so that's one of the things I kind of harp on in the issues section.

As far as reasons not to use it I mean I think in general when you're trying to make any decision about some technology to use it's just good to understand a little bit about how it works internally.

And so in this case you know understand a bit about digital signing and why you can authenticate a request without hitting a database just by checking the validity of a signature.

And so when you understand a few of those basic bullet points about something you're trying to use then you know exactly why you would use it you know and if you if your you know use case doesn't match those criteria then just don't use it.

You know just use OAuth or use just database sessions or you know it in other words don't use it just because it's cool and new and shiny right so yeah.

we need brilliant yeah that's I think that's where most people that derived

Although I to be a little bit of a stickler in in a in a funny way a cookie is a token you know like a random number which you use to look up a session so so yeah I don't know it's but I don't I don't want to be a jerk and like try and

was making the point of I think he saw um oh what's his name's um there's um oh who had that there's a long piece on why local storage is evil by a blanking on it.

Anyways I'm curious on on thoughts around security for where one should store a cookie or a token because that often comes up in the context of like don't you know don't use local storage or don't use a cookie it's insecure and I see there's actually there was a Reddit thread on this just very recently and um there's a lot of in misinformation out there so I'm curious uh what both of you think about what advice you would give around storing it.

Carlton you're a former maintainer you're a Django fellow you know I'm just uh a writer so yeah I'm probably you're familiar with this you're familiar with this with this um well I could say I think really I mean yeah

There there's been a PR open forever and I have not merged it in.

It's just been one of these things where it's like just big enough that it's just too much work for me to look at it and I never have enough time to do it.

Yeah and it's this PR to do HTTP only cookies um and to have that be where the JWT is stored.

And um I mean I think I understand the reasoning behind that because you know that's out of the reach of JavaScript so if you if your site has been XSS'd somehow then you're okay as far as that goes um at least that's my understanding of it.

So I I mean I guess that's the trade-off for me like local storage you know JavaScript has access to it and if somehow somehow if someone somehow manages to inject JavaScript into your site then you're hosed um but if you if you're using HTTP only cookies then you're not so that's kind of the main difference as far as I can see it.

I should probably read this piece that you're talking about.

I maybe I remember seeing it let

What is his name oh Randall Randall Deggs Deggs?

You know you just it's just on the client right and so you just send it along with the request and a header and it's up to the client to figure out where they want to store it.

And so that was kind of the attitude that I think led to that not being available.

But that's that's the main thing that needs to that I just need to like sit down and grow up and just merge that PR and get it taken care of.

And it just you know the maintenance of an open source package becomes really difficult over time for that exact reason.

Like my perspective on that whole thing obviously has changed considerably since this package became popular.

Because I used to be I think like a lot of typical open source users where they just kind of show up and you know the if the package doesn't do what you want is frustrating you've got work you have to get done and you just feel like you know what why don't why does the package do this it should do this you know and

Right.

And now I obviously the tables have turned and I I'm like okay now I get it it's hard.

And like you're saying you just don't have the mental space and you might have a certain standard that you're trying to maintain quality and you feel obligated to sort of essentially rewrite people's PRs in a lot of ways and um yeah

You can't merge something that you're not confident of and put a new package out

Yeah right and actually I've seen a lot of people who sort of take this approach to um the life cycle of any project where you have like a decreasing version number and when the version number gets to one or zero or some you know magic you just you can't make any more additions to it.

Yeah.

Yeah.

I was gonna

you know 12 to be soon you know 3.11 now 3.12 will be soon just soon as that you know we get the you know the pandemic lets us get the PRs finished get it out the door.

But um you know that what's there is no dying need for Django Rest framework version four.

So it's gonna be three point you know so then at what point well okay can we can we refresh the version numbering to say give a more time based um idea or perhaps to say keeping up with Django and say okay we make version four match Django version four and say you know if you're gonna be on Django version four use Rest framework version four maybe these are some ideas.

But the idea being that Django Rest framework is kind of the done it's kind of done now.

It just needs to keep ticking over.

yeah that's like I think that's a a better approach to take.

Like there's some there's just a few lines of code essentially that's doing what what is important and you just really need to zero in on that.

It's not complicated

I mean that's like I always think of if you can't if something seems incredibly complicated to you you don't really I mean that's what Einstein's thing, right?

Like you don't fully understand.

Because if you can just go well there's this and this and then blah blah blah blah I mean you can boil most things down to that but it's not always easy to do that.

Like when I like to total beginner with Django I often try to say like well you need you know a model URL view and a template and once you kind of internalize that for a single page like you're good.

Yeah I can say that I turned blue in the face but um but then when you get on the other side you're like yeah or or then you can say like like Carlton's talk he gave last year where like what is Django?

It's basically middleware and it's just like a onion in a way.

A little bit of ORM you know but that's easy to say and that doesn't mean anything though.

Anyways it what I think it's interesting too just the authentication in authentication in general is yeah is challenging and changes because the web changes I mean this is uh you know for Django itself if we had I so I so I'm I'm on the board and trying to raise money and if we had a whole slug of money the auth package is something that we would put it towards if we're gonna do updates.

Like authentication in particular is something that needs work and I think maybe even more than other things changes on the web as as best practices change.

Would you agree with that Carlton?

I mean you know they're discussing JWT on the mailing list just this week and you know um yeah there's comments about it being an overly complicated protocol and so we you know security issues have come up because of that.

And so well okay well if we're not going to have as there was a talk about bringing JWT or at least some of the foundations of it into um Django so that packages could build on it.

And it was like well no not JWT because it's overly complex and then there are better algorithms but we haven't or better um protocol better uh specs better specs to follow that are simpler and do the same thing uh give you all the benefits but without the the downside so what would they be what might we do you know this is an ongoing discussion.

Is that accurate?

Um but yeah I had a I'll I'll just touch on that briefly if that's okay before uns yeah because I had a friend who uh and and I I probably shouldn't name names too much because people in the crypto world are kind of sensitive about um being having really public personas uh because they tend to be very big targets uh security wise so um but yeah I had a friend who uh who I had

worked with earlier in my career who was kind of involved with that organization from pretty early on and so um that was my connection there and I hadn't previously really been into crypto stuff like there's a certain sort of category of technology people who are super passionate about that and super into it and um I wasn't really one of those people but I I sort of came away and in a way I'm glad because I I came in very sort of innocent like with

no preconceived like ideas about what I was getting into and and even actually a fair bit of skepticism uh because you know I recognize there's this just sort of inherent hype factor around cryptocurrency stuff that just to to me as just sort of a critical thinker just kind of turned me off frankly of it.

That's that's that was my takeaway, you know.

Like some people figured out kind of this clever way to have a a shared, uh verified, you know, cryptographically verified database, and other people are also working on kind of uh next generation like peer-to-peer like file sharing networks, and there's just a lot of interesting kinds of projects in that space, and so that was definitely eye-opening and a very useful experience for me.

So, yeah, without spending too much time on that, um I just wanted to touch on it.

So, yeah, so but but the thing I should say is that even before Ethereum, the area of tech I was starting to just personally be very interested in was the machine learning, deep learning scene.

And um and I had taken Andrew Ung's uh I think that's how you pronounce his name, Ng Un.

Yeah, I'm not sure either.

Uh Andrew Ung's uh machine learning course on Coursera.

Um I think I took

You actually completed it?

I definitely call Matthew

Like um like one of the things I think that inspired me to get really into programming originally, or one of the things I found myself pondering like really early on when I was learning to write code, is just I think any person who learns to write software has this sort of initial learning curve of how do I translate my thoughts into discrete steps that a computer could understand, and that's just like a naturally hard thing for humans to do

Like any person, I mean, it seems from my point of view, any person who's not accustomed to writing software has this initial phase where they just have to learn how to think clearly and discreetly.

Like, because you know, when you when you ask yourself, how do I like divide a number?

Like, well, you just do it, like it's just kind of a single motion of like handwriting on the paper, and um, but when you actually think about how you have to do it with some like primitive set of operations, um it's difficult.

And so you know, there's and and also there are certain classes of things which are like processes which are very natural to represent mechanically, and there are other things that which are not, like you know, mathematics number crunching calculation, or I should say calculation, not mathematics.

Calculation is very natural to represent with a computer, um, but you know, recognizing an object in the environment like humans do naturally, in a funny sort of ironic way, some of the the things we do most naturally are the hardest to represent, like uh mechanistically, right?

Like, how do we recognize objects in the environment?

How do we even like um like recognize textures, colors, like these things?

Um it's kind of interesting when you sort of you you look at the spectrum of uh phenomena, and like you there's like this gray area where things start to be very difficult for a computer to deal with, right?

And so I think really early on that was just an interesting thing to me, like just observing how I learned how to write software and how like say if I wanted to write a video game character and I wanted it to behave naturally and not like sort of awkwardly and robotically, like how would I even do that?

Like, I I was asking those questions really early on, and so um I also had the good fortune of sharing an office um at one of my earlier jobs with a guy who had done a proper PhD in AI way back in the 90s and 80s.

This is like a totally different era of AI, you know, and um, and so I think my relationship with him also helped me really get curious about that topic.

Um and I remember he showed me how to implement a backprop neural network because this is a concept which has been around since like the 80s or probably even earlier, like the whole basic idea of a perceptron, and um like the there's some of this really early work has been in the literature since decades ago and just didn't really come into popularity until recently for all kinds of different reasons, and so I

got some early exposure to that, and so you know, fast forward that so by this person I shared an office with was in the late 90s around the turn of the millennium, and fast forward uh 10-15 years, suddenly you know, we have a few sort of algorithmic advancements, um hardware advancements, like people start using GPUs to do compute, and so all these critical el

ements come together, and there's this kind of renaissance revolution in uh deep learning.

And you know, it's just one of the things that I noticed happening in the technology world.

I noticed this starting to happen, and I was thinking, oh yeah, this is I I used to be really interested in this, and all these learning resources start popping up, like Andrew Ong's course and things like that.

And so I just personally got back into it.

I know I just found it naturally fascinating, like from a technology point of view, from a philosophical point of view, like there's just so much about it which is uh there for me.

So yeah.

That's that's it.

So I guess that's uh that's the headline on our page.

Uh there's like a certain sort of collection of things that data scientists tend to do uh to help companies understand data.

And we're basically trying to automate that, and we're trying to use AI in order to explore the space of possible ways of looking at data automatically and also intelligently, like not just like doing a grid search through that's like a kind of technical term, like grid search through uh the parameters of how you might configure a data processing pipeline, um, but trying to sort of uh leverage some actu

al developments in AI algorithms to to effectively search through that space of possible ways of looking at data.

And so um the idea is that we should be able to give a company access to our data analysis uh system, and they can just sort of send their data in, and the system comes back and says, Hey, you should look at this group of customers.

There's a lot of interesting activity happening in this area, or you should um like what do you think about this this way of looking at things?

Is this interesting?

Is this not interesting?

And you can sort of like give some feedback and have that modify the behavior of the system, and so yeah.

Or I mean there's a web component that that's a like a as a broad, naive question.

I'm always curious how web interacts with machine learning because you need to store it and interact with people in some way, even though it's not the main focus.

Um but it's not necessarily Django, like it's just kind of you know, because I came into the company after a lot of those choices had already been made about what technologies to use.

I mean it is Python, um, but not exactly Django.

Uh and so

It's homegrown.

And when you say Flask, that just encompasses everything else.

You know, it's yeah,

I was gonna um there's this book, AI Superpowers, that came out in 2018 um that I read, which for a layman like myself was a really good introduction to machine learning and the capabilities.

Um and the author who I think who got a PhD in Carnegie Mellon back in the like the eighties, and then he ran Google and China and all the Apple and Microsoft.

And he was making the point, kind of what you said, that basically we finally have these deep learning algorithms that um that we were waiting on.

He said there's three things you need.

You need computing power, you need the algorithms, and you need the data set.

And so his argument is we have the computing power, we have the algorithms, they're all you know academic, you know, they're out there, and so it's a question of data.

And he's um uh I think he's from China, but he grew up in the US, but he's back.

I mean he has the Chinese point of view.

Um so he's very much like China is just gonna crush the world.

And he gives the example of when with um uh the Go, Deep was it Deep Mind, the Go game in was it twenty thirteen beat Alpha Go, yeah, that he says that was a Sputnik moment in China.

Yeah right and then that analysis yeah that and he said um they kind of realized oh wow this is a big thing and and he m gives examples of how China is sort of throwing cash you know in sort of a um government kind of way setting up these innovation centers and this and that and you know that combined with they kind of skipped the landline internet and went to phones.

He's very bullish on the Chinese approach um and kind of glosses over the surveillance stuff.

Yeah but anyways that was

reason we're doing that is because in a way we don't have the data uh people who people who have the data are Google and Amazon uh but Google and Amazon are two you know very specific organizations which have the data most people don't have the data so to speak because they don't have the the massive data sets necessary to really train these uh algorithms correctly or supervised learning algorith

ms and so there's this whole other class of algorithms where there's not a need to have a very large very well curated data set or there's less of a need and so we're sort of targeting that area because we think there's a lot of promise and I think that with um the world of unsupervised learning algorithm algorithms is the the area which has to be developed in order for AI to really become like the sort of future world technology that we think of it you know like um u

biquitous like use for everything uh there needs to be a way that we can find to leverage all the data whether or not it's labeled that's kind of the the key takeaway like

So the quality of the data set is paramount as opposed to what you know yeah maybe what you're you're saying with the you know most of the world isn't organized like that the data

And that's that's people like

Right?

I think I believe that's kind of the central idea of why you need that structured data because the computer will find its own way you know or a deterministic game like chess um or go it will figure out how it wants to get there but it needs to kind of know where it where it needs to go.

That's why it needs to be structured does that does that make any is that accurate?

Yeah that was my that's that's how I've been thinking about it but yeah

Yeah you know and so so if the if the statistical variations in the data set don't include uh information about the correct way to look at the data set then in a way there's nothing to train on that's kind of one way to say it like like if you don't have this sort of like if you have a bunch of uh samples

ve or you're trying to fit a certain style of like categorizing things and if you don't have that information then you can't you can't cue off that but there are different ways to kind of look at it like you can I I think well so I'm I'm not really a super expert in this area but this is like stuff I'd like to learn more about I think one of the approaches is to look for the sort of latent statistic statistical information in a data set and then try and find uh tr

ends in that sort of latent uh statistics in those latent states

I don't know that machines yet are

on and so forth.

A different approach is to train a a deep learning model to simply output whatever it's given.

And but what you're doing in the process is you're forcing this data to flow through a representation that's less uh what's the word has less fidelity than the original input and so what the model is then forced to do is find the essential patterns in the data that you're giving to it because it has to it has to find a way so when you're training this model it goes through this sort of narrow sort of low fidelity representation but then the

goal is to re-reconstruct the original input and so what the model is then forced to do is to find the most important sort of latent patterns in the data set and that's like sort of a shortcut in a way like you're finding this sort of patterns which are just inherently there in that kind of data and then you're saying okay well well those patterns are are clearly what's important so we don't have to waste a lot of time sort of train

ing those up from just raw classifications like that that stuff is going to be there or not whether or not we have classifications and so that's one sort of I think direction people are going in to try and find a way to leverage unlabeled data.

And that's uh that's kind of tied in with this area of research uh with the things called autoencoders variational autoencoders and um so that's a that's a really interesting particular topic in that area to me which I want to learn more about um but that's just an example of like of unsupervised versus supervised models you

ort what would be a where should they start?

I mean because Andrew Ang's course is sort of famously find fine find and then like oh my god math.

Yeah um is there a way that you would that was my experience with it um what would you suggest to like a listener of the podcast or a you know co-host who's interested in this area because I think this stuff is like the coolest stuff right I mean web stuff is a little bit you know it is what it is but sort of a solved problem but yeah right this is all uncharted frontier

I think you could you can just tell yourself like well as much as I can get away with ignoring the math for now I I should try to do that and just just try and go work through the exercises and see how far I can get and probably have to struggle through things a little bit in that sense up front.

But I think what's cool about those courses is that if you can get things working it's just really satisfying and it's really interesting to see it work.

Like I took actually there was another course I took, which was also by Andrew Ung.

It was a series of courses all about deep learning.

And there was a little bit later on in the series they get into this neural style transfer algorithm where you you have two input images to the algorithm.

One is an image which contains some artistic style essentially.

And the other is an image which contains some content that you want the style applied to.

And so, of course, the output is the content image in the style of the style image.

So you can take like a picture of yourself and make it look like Van Gogh painted it or something like that.

And uh and the algorithm works remarkably well.

And to see it work is just amazing, in my opinion.

Like to imagine that we're at a point now where a computer algorithm could so effectively sort of deal with artistic styles in this way that it's doing is just mind-boggling to me.

And so I guess my point is just if you can somehow get hands-on with the algorithms and see them work, it's just really interesting and inspiring.

Um, and I would hope that that would kind of eventually lead a person to try and learn more about the mathematics because I I personally believe there's a lot there to that that you could get as well.

But um

Well, I mean, so again, it's like uh I I would I just want to urge people not to give up on the math because especially in the case of the neural style transfer algorithm, if you understand a thing or two about the math, in my opinion, it's set it can tell you a little bit about the artistic process in humans and why people do art at all.

I I mean I I know people who are in the AI space are always kind of like a little bit uh cautious about making pronouncements like that, like you know, drawing too many direct comparisons between the ways that like um deep learning algorithms work and the way that biological brains work.

Because obviously there's a tr there's well, not obviously, but it it is supposedly the case that there's a fair bit of complexity in a biological brain, which is just not represented in a uh algorithmic brain, I guess you would say.

Um but when I was learning about that algorithm, it in my it taught me something, I believe, that I just never realized about art.

And like, why do humans at all care about abstract forms, shapes?

Like why why do we care about um representing things from the real world in this abstract form that we call art?

Like, why is that important to us?

And it seems like it could actually serve an important function in just the way that the brain works.

Like, when you look at deep learning algorithms, there's all these neurons kind of packed in the middle of the algorithm, which are doing things that we kind of don't really know what they're doing.

We don't we don't have much insight into it.

And it seems to me like it's possible that artwork could kind of serve to to give access to those kind of hidden layers somehow.

So yeah.

And again, that's like I feel like that came to me just from understanding a bit about the math of how those things work.

So I encourage people to to look into that.

Fair enough.

I can't think of a better way to end.

You are looking for help with the um simple JWT package?

Yeah.

Is that correct?

I I've been just extremely busy just with work lately, so I haven't had a lot of time to actually look at PRs and merge them up, but I'm kind of aware that that's an issue.

So yeah, potentially looking for more people to help with that, um, especially people that have like lots of just real experience um and you know association with other like prominent pop uh projects in the space.

And um, I also was looking into maybe getting it added to this organization called Jazz Band for a while.

I I was kind of back and forth on it because I thought maybe it'd still be nice to sort of have a sense of ownership over the project, but um but it may not be realistic for me to try to do that.

Uh but I I was actually having a little bit of trouble like contacting them, so I should try again and see if I can get through.

So hopefully someone listening can help us make those connections because we need you know, we need that um package to

Like there's just not many lines of code there.

So if it has fallen a little bit into sort of like you know, if I haven't had a lot of time to look at it recently, I don't think it would be very hard to sort of uh get it back into shape.

Um so yeah.

And you know, if you've been thinking about it, you know, it's and you use J simple JWT, then you know maybe the planets align.

Please come and uh and you know, make your contribution and and please be patient as people find time to to look at it and whatnot.

Like you've got to realize that it's it's not some um, you know, organization with lots of people and lots of hands, it's one person, I'll just look at one more ticket.

Like you know.

Yep.

I mean, I'm that way too, but a lot of times that's the type of person if someone's passionate enough about something, even if it's in a negative sense, that can be turned into something good.

In the same way that like for companies I've worked at, if someone takes the time to write in or someone takes the time to tell me my books are terrible, I can usually engage and flip that person.

It's people who aren't passionate, who don't care, that have no engagement with the project for the community.

So I think it's good to harness that passion.

And I always look at it as whether it's an open source thing or one of my books, if someone takes the time to do that and they have that passion, they're basically saying, convince me, you know, convince me.

Um, and they can be convinced.

It's the person who doesn't even bother writing or complaining that isn't gonna be a good thing.

It's uh opportunity to communicate.

Thank you so much for taking the time to come on and share your journey.

All right, well, everyone, we're at Chat Django on Twitter, and we'll see you all next week.

Bye bye.

Bye.