A billion new apps, not a billion new programmers

In 100x more programmers, Avery Pennarun argues that the economics of software have changed for the better. Writing something for an audience of one, a tool that scratches a single itch, is no longer a project. It’s a prompt and some tweaking. I agree with that. Where I disagree is calling it programming.

To me, programming means precisely specifying the behaviour, such that the programmer has full ownership of the outcome - deciding how edge cases are handled, making decisions about dependencies, etc. That doesn’t hold true for AI ‘programming’ by people who will never look at the generated code.

Ever since the programmers of the ENIAC were hand-wiring programs, we have been adding abstractions to the process to make it easier and more accessible - punchcards, assembly, compilers, interpreters. The common theme through this is that everything was always deterministic - the programmer’s decision made it into the application. With AI the decision-making has been abstracted away in a non-deterministic way.

Avery argues that development has got needlessly complex, and that AI now means that ‘a dentist can make something for one office’. One thing that argument overlooks is that the friction was working as an accidental guardrail. Every point of friction became a decision point to manage risk. If I’m opening a network port, how should I restrict what can access it? If I’m designing a database schema, what personal information should I be storing? If I’m choosing dependencies, how do I validate their integrity and reputation? The friction doesn’t make you safe; experienced engineers can make bad decisions that leave a database accidentally open. But it does make you confront the decision.

Avery’s coin-flip app example carries its own dangers, especially in a world with no Linux VM or an experienced developer guiding. On paper it sounds super simple - the logic is barely more than one line of code. But now we want to animate it to make it look like the App Store versions, minus the ads. So the AI now suggests a dependency; it’s plausible but completely made-up. Someone has already released a package with that name and now, unknowingly, their code is executed on every coin flip doing whatever they want. The person who built it never notices. At least the ad-ridden App Store version had some review.

Tailscale is a great product - I use it to keep my local network secure, but it only controls who can reach the app, not what the app can reach out to. The idea of 100x more builders is worrying until we have all the guardrails in place, and I understand why Apple hasn’t created an easy path to allow anyone to publish personal apps on the App Store. Avery is right that we need designed guardrails to keep people safe. We need zero-permissions by default, fully sandboxed builds, ways for non-programmers to really understand everything an application is doing and systems that can act as a circuit breaker if they detect homegrown apps are potentially dangerous.

A billion new apps could be a very good thing. But only if the guardrails arrive before the apps do.