On the positive side, all of the above have attracted many people to their communities who have contributed useful or interesting points. We all give away our thoughts and experience for free while participating in these discussions, but we gain in return from the freely shared knowledge and experiences of others. I also appreciate those who take the time to vote/moderate so that the best contributions stand out. Overall I find these online discussions extremely valuable and I’m sure others do as well.

On the negative side, there are some common failure modes. There have always been the trolls who will post offensive or misleading comments, and even when it’s a small minority, they can be disproportionately disruptive. There have always been the Dunning-Kruger contributors who would insist they were correct even as others tried to explain why they weren’t, and then the people who do know what they’re doing feel obliged to waste time repeatedly setting the record straight so no-one comes along later and gets misled by the incorrect or misleading contributions. I will never understand the current fascination with getting AI bots to contribute mediocre or just plain wrong comments in these discussions. But the worst recurring pathology by far, IMHO, is when there is some form of community moderation but that goes off the rails. It killed SO by deterring good contributors for petty reasons. It has killed many a promising subreddit; I have recently given up participating in several myself that used to be interesting, because their moderators started killing entire posts retrospectively, which repeatedly cut off discussions where some contributors had already taken the time to write up good solutions to someone’s problem or share their relevant experiences.

I’m not sure anyone has really got this right at scale yet. On smaller sites like HN, the moderation can be very good, but that relies on the fact that it can be managed by a small number of decent people. If your community is big enough that it needs to be more self-policing then the time-honoured question of quis custodiet ipsos custodes? is as relevant as ever. I strongly suspect that the only real answer to this is some kind of hierarchy where the operators of a forum set culture from the top, then just as a few negative contributors can spoil things for everyone and so some form of moderation is introduced, so a few negative moderators can spoil things for everyone and so some ability to guide or if necessary remove the use of moderation privileges is needed.

Slashdot has a meta-moderation setup where random users (with at least a minimum tenure and rating on the site) would get to vote on the quality of the moderation for randomly selected posts. I still think that this has a lot of potential for improving moderation, even if it's just used as a way of ferriting out problematic moderation.

I don't understand why it never caught on elsewhere.

Meta-moderation was an interesting idea, though they seemed to have stopped promoting it much by the time I stopped posting there often. I’m not convinced it’s as effective as having a small pool of “super-moderators” who can not only affect the prioritisation/visibility but also comment themselves to guide contributors in positive directions, but practically speaking, it might be more scalable.

I get that, but moderation points carried a lot more weight than they do most places because a randomly code chosen subset of users would only get like 5 points… so you had to choose carefully where you used them. Since it wasn’t super common to get mod points, it’s not like you were limited often.

And the users on that site, frankly, could be downright feral in its heyday, let alone now. I think it needed more structure, not less. If there was even one person that would clean up the garbage, maybe the discussion would be civil enough to allow that. They can’t even be arsed to remove swastika ascii art half the time. That’s what happens when you address fundamentally human problems with purely technical solutions.

Personally, I’m content being a dinosaur who writes one letter at a time (in handwriting that has been praised for its neatness and clarity ever since I was at school myself) or uses computers to render the text for me (where I have long had an interest in typography and quite enjoy making pretty text using elaborate cursive fonts, but for special effects and interest, not for body text and legibility).

For reasons unknown, LinkedIn seems to have decided that I’m not me a few months ago and blocked my account, though it would apparently be willing to reconsider as long as I provide whatever it is that Persona wants these days. (Evidently contacting me directly via my company — where my role as one of the directors is a matter of public record and my email address was listed in my LinkedIn profile — was too much trouble. :sigh:) Since I have no interest in giving any personal information to Persona, I no longer use LinkedIn and remain blissfully ignorant of all the AI-driven content that I keep seeing complaints about, but I do miss the occasional good news stories about people I actually know. I should probably send a formal GDPR request at some point, since my profile is probably quite misleading by now.

I’ve been noticing that this simple reality explains almost all of both the good and the bad that I hear about LLM-based coding tools. Using AI for research or to spin up a quick demo or prototype is using it to help plot a course. A lot of the multi-stage agentic workflows also come down to creating guard rails before doing the main implementation so the AI can’t get too far off track. Most of the success stories I hear seem to be in these areas so far. Meanwhile, probably the most common criticism I see is that an AI that is simply given a prompt to implement some new feature or bug fix for an existing system often misunderstands or makes bad assumptions and ends up repeatedly running into dead ends. It moves fast but without knowing which direction to move in.

This is a real problem when the "direction" == "good feedback" from a customer standpoint.

Before we had a product person for every ~20 people generating code and now we're all product people, the machines are writing the code (not all of it, but enough of it that I will -1 a ~4000 line PR and ask someone to start over, instead of digging out of the hole in the same PR).

Feedback takes time on the system by real users to come back to the product team.

You need a PID like smoothing curve over your feature changes.

Like you said, Speed isn't velocity.

Specifically if you have a decent experiment framework to keep this disclosure progressive in the customer base, going the wrong direction isn't a huge penalty as it used to be.

I liked the PostHog newsletter about the "Hidden dangers of shipping fast", I can't find a good direct link to it.

https://newsletter.posthog.com/p/the-hidden-danger-of-shippi...

This tayloristic idea (which has now reincarnated in "design thinking") that you can observe someone doing a job and then decide better than them what they need is ridiculous and should die.

Good products are built by the people who use the thing themselves. Doesn't mean though that choosing good features (product design and engineering) isn't a skill in itself.

sure 'everyone' drives so you can be a domain expert in cars. However not everyone can be an astronaught - rockets are complex enough to need more people than astronaughts and so most people designing spaceships will never have the opportunity to use one.

Yes you're right not anyone can be a domain expert. But anyone in the company needs to at least try to use the product as much as possible.

I worked in companies where even the CEO had never used the product but was telling us what to implement.

If you're bottle-necked by waiting for the users of your product to give a feedback, you clearly need to spend more time learning how to be a user yourself. Or hire people with some domain skill who can also code.

As dev team we were able to crank the speed even more and silly product people thought they are doing something good by demanding even more from us. But that was one of the instances where users were helpful :).

People use dozens of apps every day to do their work. Just think about how are you going to make time to give feedback to each of each.

That's pretty much solved by the size of the audiences. You won't give feedback on 12 apps, but 11 other people will probably do so on 11 different apps.

Of course, the issue with my domain is that there's plenty of feedback, and product owners just dismiss it. Burn down your entire portfolio to get that boosted shareholder value for the next earnings report.

Well by asking repeatedly of course but you just piss people off.

Have you ever given feedback to Atlassian, Google, Microsoft?

I suppose there is an argument that if you are building the wrong thing, build it fast so that you can find out more quickly that you built the wrong thing, allowing you to iterate more quickly.

Before AI, I worked at a B2B open source startup, and our users were perpetually annoyed by how often we asked them to upgrade and were never on the latest version.

And frankly, they were in point.

Especially in the B2B context stability is massively underrated by the product.

There is very little I hate more then starting my work week on a Monday morning and find out someone changed the tools I'm using for daily business again

Even if it's objectively minor like apples last pivot to the windows vista design... It just annoys me.

But I'm not the person paying the bills for the tools I'm using at work, and the person that is almost never actually uses the tools themselves and hence shiny redesigns and pointless features galore

Way too often that is used as an excuse for various forms of laziness; to not think about the things you can already know. And that lack of thinking repeats in an endless cycle when, after your trial and error, you don't use what you learned because "let's look forward not backward", "let's fail fast and often" and similar platitudes.

Catchy slogans and heartfelt desires are great but you gotta put the brains in it too.

I doubt GP is suggesting ‘go ahead and be negligent to feedback and guardrails that let you course correct early.’

Plugging the Cynefin framework as a useful technique for practitioners here. It doesn’t have to be hard to choose whether or not rigorous planning is appropriate for the task at hand, versus probe-test-backtrack with tight iteration loops.

A lot of people are so enamored by speed, they are not even taking the time to carefully consider the full picture of what they are building. Take the HN frontpage story on OpenCode: IIRC, a maintainer admitted they keep adding many shallow features that are brittle.

Speed cannot replace product vision and discipline.

This won't really stop until investors start judging on quality and not quantity. But a lot of those are thinking in finances, and the thought of removing their biggest cost center is too tempting to not go all in on. So they want to hear "we made this super fast with 2-3 people!" instead of "we optimized and scaled this up to handle 400% more workload with double the performance".

Discovery is great and all but if what you discover is that you didn't aim well to begin with that's not all that useful.

This reminded me of the idea that civilization is already a misaligned superintelligence, and that technology (incl. AI) just moves it faster in the wrong direction.

That's basically the problem of supermorality. If you're an actually benevolent AI, do you do what civilization tells you? Or do you do what is good? What happens if you disagree?

Thus far, AI has been good... For venture capitalists. Jury's out if it's good for humanity and civilization at large. There have been a lot of benevolent usages of AI thus far, but also a lot of bad.

As for those who disagree with the "benevolent AI," I think they just get sent to the gallows (either metaphorically or literally)

Exactly this. Velocity is a vector. It has magnitude (aka speed) and direction.

Our industry has chased magnitude over all else for so long. Now we can put nitro in everyone's car and we get to where we wish to go very fast. Suddenly bad direction-setting is getting feedback where there used to be friction and natural time to steer.

My greatest hope is that a ton of bad leaders and middle managers end up finally getting exposed due to the advent of AI. (Will I be disappointed? Almost certainly yes.)

In the last year or so I've been able to prototype it and accelerate the development quite significantly using Claude and pals, and now it is very close to a finished product. One one hand there's no doubt in my mind that the LLM tools can make this sort of thing faster and let you churn through ideas until you find the right ones, but on the other hand, if I hadn't had that slow burn of mostly just thinking about it conceptually for 10 years, I would have ended up vibe coding a much worse product.

It also moves fast with a tendency to pick the wrong direction (according to the goal of the prompter) at every decision point (known or unknown).

The number of times I've seen them get the wrong end of the stick in their COT is ridiculous.

Even when I tell them to only implement after my explicit approval they ignore this after 2 or 3 followups and then it's back to them going down blind alleys.

If you need to spend actual humans searching every 10 degrees (or more if they need to go far), the cost might not be worth it. What if they don't come back? Every human scouting is not foraging for the group or protecting them from whatever is in the jungle,

Now if you have a near infinite capacity of autonomous drones you can send one every degree from your position and get an approximate estimate whether that direction is safe or not.

It's the same with programming, you can do a TON of exploratory crap with near zero extra cost. Just to see if that's the right direction or not. Basically lean in to the "fast but inaccurate" aspect of AI.

Like I had a hare-brained idea of a local web-based file manager / media browser that would use YOLOv8 and CLIP to tag and classify images and videos as you browse. Took me about 30 minutes of active time over a few evenings while doing other stuff to conclude that, yes, it IS doable. Now I can focus my actual brain on it.

A proper capitalist system will tend toward the right direction as directed by the market yea? All of this neuroticism about AI doesn't matter.

Working or useful software? AI hasn't produced any at all since 2023.

Sorry, but I don’t understand what you mean here. What do we win by being faster at producing the wrong things?

1) a lot of shallow, orthogonal directions is better than 1 deep, careful approach

2) There's no social aspect to churning out a bunch of slop that will affect the perception of potential "right things" later. My domain can be particularly grudgeful in this regard.

2) I read that part twice and could not figure out what it is you are trying to say.

I too declined on privacy grounds.

One security checking tool that has genuinely impressed me recently is CodeQL. If you’re using GitHub, you can run this as part of GitHub Advanced Security.

Unlike those naïve tools, CodeQL seems to perform a real tracing analysis through the code, so its report doesn’t just say you have user-provided data being used dangerously, it shows you a complete, step-by-step path through the code that connects the input to the dangerous usage. This provides useful, actionable information to assess and fix real vulnerabilities, and it is inherently resistant to false positives.

Presumably there is still a possibility of false negatives with this approach, particularly with more dynamic languages like Python where you could surely write code that is obfuscated enough to avoid detection by the tracing analysis. However, most of us don’t intentionally do that, and it’s still useful to find the rest of the issues even if the results aren’t perfect and 100% complete.

The latest drop in the bucket was a comment adding a useless intermediate variable, with the justification being “if you do this, you’ll avoid CodeQL flagging you for the problem”.

Sounds like slight overfitting to the data!

For non-SaaS products it doesn’t matter. Your customer’s security teams have their own scanners. If you ship them vulnerable binaries, they’ll complain even if the vulnerable code is never used or isn’t exploitable in your product.

Nope.

> Dependencies should be updated according to your development cycle, not the cycle of each of your dependencies. For example you might want to update dependencies all at once when you begin a release development cycle, as opposed to when each dependency completes theirs.

and is arguing in favor of targeted updates.

It might surprise the younger crowd to see the number of Windows Updates you wouldn't have installed on a production machine, back when you made choices at that level. From this perspective Tesla's OTA firmware update scheme seems wildly irresponsible for the car owner.

By Rice's Theorem, I somehow doubt that.

If dataflow is not provably connected from source to sink, an alert is impossible. If a sanitization step interrupts the flow of potentially tainted data, the alert is similarly discarded.

The end-to-end precision of the detection depends on the queries executed, the models of the libraries used in the code (to e.g., recognize the correct sanitizers), and other parameters. All of this is customizable by users.

All that can be overwhelming though, so we aim to provide sane defaults. On GitHub, you can choose between a "Default" and "Extended" suite. Those are tuned for different levels of potential FN/FP based on the precision of the query and severity of the alert.

Severities are calculated based on the weaknesses the query covers, and the real CVE these have caused in prior disclosed vulnerabilities.

QL-language-focused resources for CodeQL: https://codeql.github.com/

Is CodeQL special cased for your code? I very much doubt that. Then it must work in the general case. At that point decidability is impossible and at best either false positives or false negatives can be guaranteed to be absent, but not both (possibly neither of them!)

I don't doubt CodeQL claims can be demonstrably true, that's still coherent with Rice's theorem. However it does mean you'll have false negatives, that is cases where CodeQL reports no provable claim while your code is vulnerable to some issues.

Clearly it is still possible to generate a false positive if, for example, CodeQL’s algorithm thinks it has found a path through the code where unsanitised user data can be used dangerously, but in fact there was a sanitisation step along the way that it didn’t recognise. This is the kind of situation where the theoretical result about not being able to determine whether a semantic property holds in all cases is felt in practical terms.

It still seems much less likely that an algorithm that needs to produce a specific demonstration of the problem it claims to have found will result in a false positive than the kind of naïve algorithms we were discussing before that are based on a generic look-up table of software+version=vulnerability without any attempt to determine whether there is actually a path to exploit that vulnerability in the real code.

Looking at the docs, I’m not really sure CodeQL is semantic in the same sense as Rices theorem. It looks syntactic more than semantic.

Eg breaking Rices theorem would require it to detect that an application isn’t vulnerable if it contains the vulnerability but only in paths that are unreachable. Like

    if request.params.limit > 1000:
         throw error
    # 1000 lines of code
    if request.params.limit > 1000:
         call_vulnerable_code()

It’s probably demonstrably true that there is syntactically a path to the vulnerability, I’m a little dubious that it’s demonstrably true the code path is actually reachable without executing the code.

I would love to hear what kind of local experience you're looking for and where CodeQL isn't working well today.

As a general overview:

The CodeQL CLI is developed as an open-source project and can run CodeQL basically anywhere. The engine is free to use for all open-source projects, and free for all security researchers.

The CLI is available as release downloads, in homebrew, and as part of many deployment frameworks: https://github.com/advanced-security/awesome-codeql?tab=read...

Results are stored in standard formats and can be viewed and processed by any SARIF-compatible tool. We provide tools to run CodeQL against thousands of open-source repos for security research.

The repo linked above points to dozens of other useful projects (both from GitHub and the community around CodeQL).

I’d be interested in what kinds of false positives you’ve seen it produce. The functionality in CodeQL that I have found useful tends to accompany each reported vulnerability with a specific code path that demonstrates how the vulnerability arises. While we might still decide there is no risk in practice for other reasons, I don’t recall ever seeing it make a claim like this that was incorrect from a technical perspective. Maybe some of the other types of checks it performs are more susceptible to false positives and I just happen not to have run into those so much in the projects I’ve worked on.

The patterns we had established were as simple, basic, and "safe" as practical, and we advised and code-reviewed the mechanics of services/apps for the other teams, like using database connections/pools correctly, using async correctly, validating input correctly, etc (while the other teams were more focused on features and business logic). Low-level performance was not really a concern, mostly just high-level db-queries or sub-requests that were too expensive or numerous. The point is, there really wasn't much of anything for CodeQL to find, all the basic blunders were mostly prevented. So, it was pretty much all false-positives.

Of course, the experience would be far different if we were more careless or working with more tricky components/patterns. Compare to the base-rate fallacy from medicine ... if there's a 99% accurate test across a population with nothing for it to find, the "1%" false positive case will dominate.

I also want to mention a tendency for some security teams to decide that their role is to set these things up, turn them on, cover their eyes, and point the hose at the devs. Using these tools makes sense, but these security teams think it's not practical for them to look at the output and judge the quality with their own brains, first. And it's all about the numbers: 80 criticals, 2000 highs! (except they're all the same CVE and they're all not valid for the same reason)

I completely agree about the problem of someone deciding to turn these kinds of scanning tools on and then expecting they’ll Just Work. I do think the better tools can provide a lot of value, but they still involve trade-offs and no tool will get everything 100% right, so there will always be a need to review their output and make intelligent decisions about how to use it. Scanning tools that don’t provide a way to persistently mark a certain result as incorrect or to collect multiple instances of the same issue together tend to be particularly painful to work with.

https://kotlinlang.org/docs/whatsnew23.html

https://github.com/github/codeql/issues/20661

Yes, but the “MVC” pattern used by various back-end web frameworks that borrowed the term a while back actually has very little to do with the original MVC of the Reenskaug era.

The original concept of MVC is based on a triangle of three modules with quite specific responsibilities and relationships. The closest equivalent on the back-end of a web application might be having a data model persisted via a database or similar, and then a web server providing a set of HTTP GET endpoints allowing queries of that model state (perhaps including some sort of WebSocket or Server-Sent Event provision to observe any changes) and a separate set of HTTP POST/PUT/PATCH endpoints allowing updates of the model state. Then on the back end, your “view” code handles any query requests, including monitoring the model state for changes and notifying any observers via WS/SSE, while your “controller” code handles any mutation requests. And then on the front end, you render your page content based on the back-end view endpoints, subscribe for notifications of changes that cause you to update your rendering, and any user interactions get sent to the back-end controller endpoints.

In practice, I don’t recall ever seeing an “MVC” back-end framework used anything like that. Instead, they typically have a “controller” in front of the “model” and have it manage all incoming HTTP requests, with “view” referring to the front-end code. This is fundamentally a tiered, linear relationship and it allocates responsibilities quite differently to the original, triangular MVC.

The model can be completely unaware of any specific views or controllers. It only needs to provide an interface allowing views to observe the current state and controllers to update that state.

In practice, views and controllers usually aren’t independent and instead come as a pair. This is because most modern UIs use some kind of event-driven architecture where user interactions are indicated by events from some component rendered by the view that the controller then handles.

My go-to example to understand why this architecture is helpful is a UI that features a table showing some names and a count for each, alongside a chart visualising that data graphically. Here you would have a model that stores the names and counts as pure data, and you would have two view+controller pairs, one managing the table and one the chart. Each view observes the model and renders an updated table or chart when the model state changes. Each controller responds to user interactions that perhaps edit a name or change its count — whether by typing a new value as text in an editable table cell or by dragging somewhere relevant in the chart — by telling the model to update its state to match (which in turn causes all views observing the model to refresh, without any further action from whichever controller happened to be handling that user interaction).

In practical terms for a React application, we might implement this with a simple object/Map somewhere that holds the names and values (our “model”) and two top-level React components that each get rendered once into some appropriate container within the page. Each component would have props to pass in (a) the current state and (b) any functions to be called when the user makes a change. Then you just write some simple glue logic in plain old JavaScript/TypeScript that handles keeping track of observers of the model, registering an observer for each top-level component that causes it rerender when the state changes, and providing a handler for each type of change the user is allowed to make that updates the state and then notifies the observers.

There are lots of variations on this theme, for example once you start needing more complicated business logic to interpret a user interaction and decide what state change is required or you need to synchronise your front-end model state with some remote service. However, you can scale a very long way with the basic principle that you hold your application state as pure data in a model that doesn’t know anything about any specific user interface or remote service and instead provides an interface for any other modules in the system to observe and/or update that state.

The common criticisms are largely true: it does start slow with some weak episodes in season 1, some of the acting is a bit wooden, the CGI hasn’t aged well, season 5 is slightly anti-climactic because they largely wrapped up the main plot arc in season 4 in case the final season didn’t happen.

On the other hand, it had an epic storyline that spanned not just episodes but multiple seasons in a way that no-one had really tried in sci-fi before. That storyline made sense and weaves in and out of the individual episodes because it was planned out in advance. The world-building and development of different cultures and how they relate is generally strong.

Against that over-arching backdrop, it also had a lot of good individual episodes. They had genuine character development. They explored social and moral issues as well as any show of that period. They varied from diplomatic and political settings to the adventure of deep space exploration to almost pure action episodes. They varied in scale too, from relatable stories about a single individual, to stories about a whole planet or culture, right up to the fate of the known universe.

Much of the acting criticism is directed at the main leader characters, but I’ve always thought this is slightly unfair, because the script often relies on those characters to carry the plot and provide much of the exposition and those tend to be the more formulaic parts. The same show also features some of the best acting and main character arcs in TV sci-fi, with the relationship between Londo Mollari (played by Peter Jurasik) and G'Kar (Andreas Katsulas) being one of the great double acts. There were many good moments from the rest of the ensemble cast too, from the doctor wrestling with his conscience to a certain wave. And then there were some great supporting/recurring roles, from the light relief of Zathras (and Zathras, Zathras, Zathras, Zathras and Zathras, of course) to the much more serious Bester (arguably Walter Koenig’s finest work).

If you haven’t watched B5 and you’re a fan of epic space sci-fi, I highly recommend it even with its flaws. The first season is a slow burner (although it also has a lot of subtle set-up that you won’t appreciate until much later) but it picks up. If you’re the type of viewer who can’t stand filler episodes, there used to be some relatively spoiler-free guides to which early episodes you really need to watch and which you can skip, so you could look for one of those. Don’t watch In The Beginning first, though; it’s a prequel TV movie that has lots of spoilers about the main story that you’re not supposed to know yet when you watch the early series.

Has it really, though? Or has it just shifted its corporate priorities away from its traditional stalwarts of Windows and Office, but in doing so caused disruption to users that had bet on the eternal stability of Microsoft’s product line? I don’t like the current direction of Windows any more than the next guy, and personally I’ve made other choices in recent years, but as a general principle, I’m not sure how reasonable it is to expect a business to continue offering the same product or service indefinitely if market forces are pushing it elsewhere.

IMHO, a deeper problem here is that we collectively allowed a near-monopoly culture to develop around desktop operating systems and basic business software. Instead of having a healthy degree of competition between providers and using standardisation to ensure interoperability and portability of our data, we’ve ended up in a “too big to fail” situation where many users have all their eggs in one basket and that basket has a rapidly growing hole in the bottom and looks like it’s going to fail anyway.

There are also reasonable arguments to be made about length of support for products already sold, forced obsolescence and ratcheting “upgrades”, where possibly the actions of some providers in the market are exploitative in ways we should not allow, and therefore regulating to prevent the undesirable behaviours might be in the public interest.

Ultimately, I think a combination of restricting customer-hostile practices while also encouraging a healthy degree of competition and interoperability in important markets would be best for the users and fair to the developers. Sadly, right now, we have neither of those things, and that’s how we get Windows 11, the mobile device duopoly, numerous examples of products or services being locked down against their users’ interests, online services that people increasingly rely on for fundamental aspects of their normal lives and yet that have little real obligation to those people in return, and assorted other ills of the 21st century tech landscape.

Market forces aren't pushing it elsewhere. The cornerstone of Microsoft still is Windows and Office. If those would not exist nobody in their right mind would choose Azure over AWS or GCP.

By letting their guard down on those fronts and letting Windows and Office degrade more and more, they are exposing themselves to the risk that someone ends up building a competitive company filling those niches and people risk the switching cost in order to get away from ever increasing Office 365 subscription costs.

There's a really interesting dynamic here in that Azure has a solid spoiler role for large organisations that don't want to be commercially dependent on only AWS, and they can probably get really solid discounts if they're aready on board elsewhere. It's something that doesn't play out with Microsoft's other products nearly so much: you get shouted down if you want to have desktop diversity, but having a multicloud strategy is (in my experience) looked on as essential.

Again, is it really, though? I have no special insider knowledge so perhaps this is just a misunderstanding of the public information, but just going by the organisation structure, leadership comments and recent financials, it looks like Windows makes up a relatively small part of Microsoft’s revenues these days, while the traditional desktop Office applications seem to be almost lost in the noise. The emphasis seems to be firmly on cloud services, though admittedly with all the rebranding from Microsoft lately, I find it hard to understand even what basic products and services they offer any more.

Google also makes most of their money in "ads" but if they were to axe Search and Youtube (which in an reduced view are only sales funnels for ads), they wouldn't have much of a business left.

Windows appears to be positioned more as a platform to reach all the online services now, rather than its traditional role as a desktop OS. Can you even activate it without being online and having a Microsoft account any more? I’m out of the loop, so genuinely don’t know the answer to this one.

Office — or whatever it’s being called after the recent changes — also appears to have morphed into something quite different. I tried searching just now to see if you could still buy a permanent licence and install the classic applications like Word and Excel locally, and some sources implied you could, but I didn’t actually find any way to buy it in five minutes of looking around office.microsoft.com. As far as I saw, that site is now 100% about the online SaaS version and trying to get users to save their documents in the cloud. For businesses, the strategy seems to include promoting other online services like SharePoint and Teams as well.

So I think I stand by my original argument, though I don’t think it necessarily disagrees with yours. Windows and The Software Product/Service Formerly Known As Office might still be a significant part of Microsoft’s sales funnel, but they aren’t the products that Windows and Office used to be any more. The products they used to be have been repurposed to support an online-first corporate strategy, along with almost everything else in the Nadella era. Would Microsoft care if 100% of their customers stopped using Windows tomorrow and jumped to Apple or Linux systems, as long as they still used the other services that generate most of Microsoft’s revenues these days? I’m not entirely sure they would.

You mean Windows and Microsoft 365 Copilot App?