David Yanacek on Vibe Coding vs. Spec-Driven Development: Balancing Speed, Security, and Scale

Hey, everyone. Welcome back here to Tech Drunk tv. Let me introduce you to our next guest, David Yek.

David is the senior or a senior principal engineer, an Amazon Web Services. David, welcome to Text Drug tv. It's great to have you on here.

Thanks For having me. It's wonderful to be here. Thank you.

David. I always like to start off with giving our audience a sense of who it is they're talking to. So, look, there's only a 15, 20 minute interview, so let's not get crazy, but give people maybe a sense of kind of your journey to how you got here today and you know, what kind of your, your story.

Certainly. Well, I'm a, I'm a software engineer who has built a 20 year career at Amazon doing basically a singular purpose with basically one thing in mind, and that is making developers' lives easier. Uh, it's a somewhat selfish motivation because I'm a developer and so I'm making my own life easier.

Uh, but this has been from, from making it easier to write code, to running it in production. So this is things like I, I found it, uh, distracting to have to spend a lot of time operating databases, uh, when I have a system that depends on a database. And so when I heard we were building a Amazon DynamoDB at a WSI joined the team and, and since then I've never had to do database operations again.

So it's really a, uh, this singular motivation of just making my life easier and making, making ev all, all developers everywhere is life easier coding and running things in production. Absolutely. Pretty cool stuff, huh?

Um, so David, we're gonna talk today about vibe coding and, and specifically about vibe coding, security. Um, you know, depending who you talk to, the amount of code that's being generated now either exclusively by AI with the help of AI is phenomenal, right? We, we might be, I've heard stories we might be generating twice as much code as we have in the past.

I, I think actually I've seen, uh, I've seen, uh, stats where Google and Microsoft admit to 30% of the code they're generating being AI generated almost a third. Um, I know AWS right? With between Bedrock and, and so many of your AI offerings, you guys gotta be seeing a ton of AI generated code.

Um, is it, is this a Well, 'cause you know, the threshold question for me is, is this a, is this the new normal or is it you ain't seen nothing yet? I'd say it's more, uh, the latter. I'd say it's more, you ain't seen nothing yet.

I mean, I, I think we're, we're seeing as, as more and more developers adopt Vibe coding, they're just able to reach deeper into their backlogs, get more done, and have actually a lot of fun while doing it. Uh, I think, uh, the, you can even see the, the acceleration as the practice and the tools improve. I'd say Vibe coding started as sort of a, a one shot to a, a large language model.

You would issue a prompt say, Hey, generate a, a code, a piece of code or a class or something that does this. It would return the code, but it was tedious because I would have to run the code myself, compile it, paste, copy the errors that I got from compilation or tests into the LOM and say, Hey, I got these errors, can you fix them for me? So that was tedious and slow.

And so that was, and, and not all that much fun and successful. And so what then if you just look at the evolution of the technique and the tools, then agents started getting applied to it. So an agentic loop where instead of, uh, me having to go back and forth with the errors, you let, you let the agent both call the LLM to say, Hey, the, the user has asked for code that does this, and it will run the code itself and see its own errors and fix them.

And so that got that improved things. Now I can let it go in the background and it finds and fixes its own errors. But then the latest generation, and now this, these approaches I think were initially very good for prototypes for greenfield projects, smaller projects, because they would have some, they would kind of wander off if you give it too much to work on at once, they might forget what you were trying to get it to do.

And so, but the more, the more recent, uh, the, the more recent set of tools around AI coding, I think is why I think that this is here to stay and only accelerating because those more recent, uh, AI generated AI tools for, uh, for coding, um, follow a spec driven development approach. So instead of letting the agent kind of wander and, and run into obstacles and forget what it's doing, you spend more time with the agent upfront, uh, deciding what it is we're gonna do, you plan, what are the requirements, and you flesh those out, get a better, better idea for what it's gonna do. Uh, then you come up with a design and you agree, you work through the design upfront instead of, uh, thinking like 30 minutes into a session.

Uh, and then you, uh, uh, and then you work through the tasks so it can break things down. So I think that this, this evolution of the tooling of where we go from one-shot prompts to loops to now SPECT driven development, um, we don't know what's next, but I, I, I'd say we've now gotten into, we can work on enterprise code bases, large existing code bases and be successful and, and accelerate development. You know, one, one of the things that, that we're seeing here in, in talking to, you know, a lot of different people is the, if you analogize this to low code, no code, right?

'cause originally, I think that's what they were kind of comparing vibe coding too. Mm-hmm. Right.

Everybody could code. 0. Uh, now I could become a developer to using vibe coding, much like in no code, right?

And, and we saw this in low code, you had sort of what they called the citizen developer versus the professional developer, but the wrap on the no code stuff is, look, if you're doing simple apps, it's okay, but anything sort of enterprise worthy or, you know, somewhat sophisticated, it's just not up to the task. I think originally when we first started seeing Vibe code, and, and keep in mind that was probably, what, 10 months ago, 11 months ago it was. So yeah, The term only came in February as far as I saw.

Yeah, Me too. Shortly before MCOs or after, uh, uh, MCR, right? But anyway, the, the idea was, yeah, it's good for simple stuff, script kitty stuff, right?

But you're not gonna really use it for a, you know, a full-blown sophisticated application. But that's changed. Oh, yeah.

I think we are using it now for, you know, enterprise worthy applications. And to me that is a, that's a sea change, right? It, it, it's, it goes from being, and I don't mean to disparage the low-code, no-code folks, but it goes from almost being a toy to being a pro tool.

Yeah. We've even seen vibe coding within itself turn, turn from only being capable of smaller applications to being capable of building large applications. Um, even so, uh, AWS uh, small team in AWS built an IDE, an age agent ID called kero.

And this does this vibe coating, but it brings this spec driven development approach to it. And we actually built Kero with kero once it got to the point where we could use it, uh, to, to execute pacs. Um, the team actually built a feature that I asked for, um, which was on my list of, uh, when you're vibe coding, uh, sometimes, uh, you let the agent go run through a bunch of tasks and maybe you, you put your attention elsewhere, maybe read a document or something.

And I found that when I was reading and it was coding in the background, sometimes it would be waiting for me to approve a command or to answer a question or clarify something, and I wouldn't notice. And so I would be really, uh, sad. I would say, well, oh, shoot, I, I blocked the productivity of this agent for 10 minutes.

I wish that my operating system had notified me and said, Hey, you, you were waiting on something and this was on the KIRO team's backlog to implement. They planned on implementing this feature, but they weren't able to get to it yet. And they said, well, you know, I bet it was, they had scoped it out as a two week task.

And instead they said, well, let's, let's use a spec. Let's have Kiro implement itself. Um, it's kind of complicated as a two week task because you have to interface with every operating system has a different way of doing notifications, inter process, calling, uh, different APIs, different whole structure of what the code needs to be.

And so they gave this task to Kira, where they worked with a spec, they worked and said, okay, here's what I needed to do. Here are the operating systems, here's how it needs to work and plug in, here are the requirements. And, and it came up with the design.

They worked together and they got it done in two days without even actively working. Um, so that was, uh, that was a huge change of enterprise level code, uh, two weeks to two days. Uh, that's a pretty able to get further into the backlog than we were able ever able to do, because these specs are able to steer the agent better.

Excellent. It. So now we come to the next bottleneck because, you know, the theory of constraints is as soon as you clear one thing, you hit the next thing, right?

Kinda outta the Phoenix project. And the goal, I've been in security 25 years and all my 25 plus years and all that time, it's a rare occurrence where security is out ahead of innovation like this. And I don't, it looks like vibe coating's no different.

Yeah. Vibe coating could spit out code, but how secure is that code? And what are we doing to keep up with this torrent this flood of more code, you know, that needs to be secured and we, we can't just put it out there.

Um, and I get you, you need AI to fight AI and it's might, you know, do we need Vibe sec? Do we need vibe security to keep up with Vibe coding or something else? What do you think?

Well, at the end of the day, when I have an agent write code for me, that's my code. And so I kind of, I think of it as, well, it is my code. I treat it as that.

And, and it goes through, we need the same kind of focus on automated review, automated security review of things like we, that we have today in, in enterprise environments. Um, and so I think about, um, the other, the other approach I think that we go with is, is the deering, the coating, uh, kind of unpack where can, where can bugs creep in, uh, to the code? And I find those bugs keep creep in when vibe coding, when say the prompts are too vague.

If we start with something that is a, a vague set of requirements, it might decide to, um, you know, go off and, and, uh, make up its own, uh, its own approach or its own requirement. So that's where, okay, spec driven development, I think is actually improving our security, uh, of use of it because we agree ahead of time how the coach can be structured. Um, the other part that can come in from a security standpoint is if it, um, kind of forgets over time what we had agreed on.

So we can say ag agree upfront how the code is gonna be structured from a security standpoint, and then later on with vibe coding, if, if, if we're not using the tools correctly, they can, uh, go off and forget that kind of high level mission. And then I would've to, I will notice later that it went off and got distracted and removed something that I wanted to be there. But with Spectrum and development, not only do we agree on what's going to happen in the code and how it's going to be structured, but it also breaks down the implementation into tasks.

And this is important for LLMs because if an LLM tries to make something from scratch all in one shot, it's going to get distracted. It's gonna forget things. It has to manage its memory, its working memory, its context window.

And by breaking things down into smaller tasks, it can keep that higher level objective in mind as it works on a smaller task without getting crowded out with like the, the entire backlog of what it's trying to eventually do. So actually just mindful use of spec driven development, I think is the, is the starting point to, to secure vibe coding. Very cool.

Um, what does it mean for the security industry, for the security professionals though, Dave? com 12 years ago, and I did it because I'm a security person. And I thought like, what be, what we call today, DevSecOps was gonna be finally the holy grail that we were looking for, right?

Shift left, get security stuff fixed earlier, faster, better. And what we found out is developers aren't security people. Security people are security people.

We could, you know, developers want to deliver quality code, but they're not interested in being security people. How do, where does the security pro fit into this whole thing? I think the security pro has a very important and, and continued job in this, uh, in this effort.

Uh, they're one way that I've seen security teams be, uh, effective. By the way, uh, I've been, the entire time I've been, my whole 20 years of coding, I've been doing DevOps. Just like you're saying, like where I am a developer who operates, that's what that means.

There's no DevOps role, it's just Dev does the ops and Yep. Similarly, the security at the end of the right, at the end of the day, we're on the hook for everything. The, the finished product.

Mm-hmm. There's no, there's no frontline team, uh, running this stuff for us. And that means all the security, all the operations, all needs to be baked in.

And so what I really appreciate when security teams, when do this is when they help give me the guidance that I need and the tools that I need. So it just happens the right way from the start. And so that it catches me when I'm, when I do something that they didn't intend.

And so this is, they, so what does, what these security teams end up doing for me, um, is like the, the code review level, like pull request, review level, or along the deployment line, uh, pipeline doing the tests and verification for me. But I think this and that, that stays going forward, um, how to incorporate security best practices into spectrum and development, I think is actually a new, uh, emerging and a very important role for security teams. If I want to have a security standard around the way that my company does something or the, the things that I'm looking for to make sure it's incorporated, I can provide these agent ides with some, um, well, we can call them specs, we can call it steering, we can call it context.

Um, but ultimately I need to view, give my instructions of how to think about security in different contexts to a coding agent. And so things like Qro offer these, uh, steering files. Uh, so steering is something that's brought in no matter what I'm working on.

It's just these, these kind of truths to always keep in mind as it's implementing something. And so, um, the security teams, central teams, these, uh, cloud center of excellence is platform engineering, security organizations. They can provide steering that gets in inserted to all of these projects so that it's just sort of a, a directory of, Hey, remember these things that'll be consulted, uh, as it as it goes and implements things.

So these security requirements, best practices, um, they're, they can actually shift left all the way into the, as the code is being written by finding the right way to hook into, uh, the agentic IDE that's being used like in in Kero. This would be steering files, You know, as we're in, we're coming into year two of this kinda revolution. I mentioned, uh, MCOI, we talking about vibe coding, and we said at the outset, kinda ain't seen nothing yet.

Give us what you mean by that. What do you think we can expect? You know, AWS reinvent is in like a month maybe, right?

Mm-hmm. Yeah. About a month from now.

Um, what without, I realize you can't, you know, you can't go into announcement. They'll, they'll make it reinvent, but you know, what, what's it, it's usually reinvent is a good forward view into the year ahead from where you sit. What do you think?

Well, if you look at the, the, the pace of things being released, the pace of innovation, kiro being on a, a weekly or biweekly launch cycle with new features coming that often, um, I think that's sort of the, uh, that's what I mean about the acceleration. When you start to use these tools to build these tools, you get this acceleration effect. It's just more and more happens.

Um, if you look at other, um, recent rele releases, you, you were talking about, um, you mentioned, uh, no code, low code. We've actually seen some interesting approaches to that, um, in the, uh, Amazon Quick Business Suite, quick Suite, um, this is actually makes it so that, uh, business users can, uh, can have write kind of workflow applications, things that are, that are a, uh, kind of a more standard formulaic, uh, agentic application, uh, that ties to their business data, uh, right there. So that actually released in the, in the last, uh, couple weeks or yeah, couple weeks.

So I think in, in, in the lead up to, to reinvent, you're seeing, uh, a theme of, of more and more good application of agen technology. And, and so I'm excited about reinvent. I'll be there, hopefully, uh, hopefully other folks are there.

Look me up and we can, we can chat. Uh, it's a good, it's a good learning conference to, to, for everybody to, to network and, and learn new techniques. And I'll tell you, there are a lot of, of new techniques to learn new practices like spectrum and development that we need to be always, uh, always just improving ourselves as, as developers and learning new practices, how to incorporate security into these practices like you're talking about.

I think these are all very important topics that, that I think people should expect to learn a lot about at Reinvent. Absolutely. We'll be there doing video all week, so I'm excited as well as well, we'll have reporters doing stories and our FU analysts will be there doing analysis and fact gathering.

So it is, it's a great, great, great event. Reinvent. David, I want to thank you for coming here on Text Trunk TV and talking vibe coding and vibe security with us a little bit.

You know, if we don't speak at reinvent, you have an invitation. Come on anytime you want. We, we talk about this stuff all day, so happy to continue the conversation forward.

Fantastic. Yeah, so you're, you're, you're asking some good questions and, and poking at this in the right way, so thanks for spreading the word about it. Thank you.

David Yauch, senior principal engineer, AWS Amazon Web Services here on Tech Drunk tv. We're gonna take a break. We'll be back in a minute.