Tech Connects Episode 32: Tariq Shaukat, co-CEO of Sonar, on a future of cleaner code

It's a great question, and thanks Nick again for having me on as well. It's really exciting to be here. So when we talk about clean code, we really are trying to describe code that is reliable, that is secure, that is maintainable—code the way it should be written. That is in part on each individual developer and how do you check your work, if you will—how do you really make sure that you're developing the right way. But it's also for the team, and it's also for the company to say how are we actually building things in a way that is going to kind of live over time, right, and you're going to be happy with over time.

No, and it's a great question. And I think it's important for me to emphasize that what we are really doing—we are not an AI assistant doing coding for you and trying to cut the human out of the process in any way, shape, or form. What we do is we look at lines of code as you are writing them and after you've written them, but actually it works best when you're writing them. Essentially, we look at those lines of code and we prompt the developers to think about this, this, or this. And so a lot of times that is, hey, did you know you've already defined this variable here and now you're defining it here, and maybe that's just overly complex. Or did you know that you've introduced this dependency that you probably didn't need to introduce. Things like that really become core to the recommendations. And fundamentally it's then up to the developer—we do not do any editing for you, we are not doing autocorrect. If you think of this as writing prose in Google Docs or something like that, we're not autocorrecting, we're not anything like that. What we are doing is basically highlighting for you things that you should consider. And so for us, it is helping an amazing developer continue to be amazing and focus on the things that they want to focus on, and giving them hints and tips and suggestions that they can consider. And it's helping even people who are just starting out to learn as they're coding, right, to say oh my gosh, I didn't really think that that is what I was doing. So helpful, let me go ahead and correct that now. And again, part of the point here is catch it while you're coding as opposed to a couple days later you're realizing you built it, or a couple years later somebody realizes you built this and they can't understand your code anymore. So it's all of those pieces, but it's fundamentally a tool, it's a platform, it's a series of platforms that are meant to assist developers, assist whoever is writing the code.

Yeah, and even in ways that people don't really think about every day. I've had code bases I've inherited where the commenting, for bizarre historical reasons, was done in a language that nobody else in the company speaks at the moment. We had a couple of Czech developers at one point who were doing all of their commenting in Czech, and nobody in the company read Czech. So you really want to build code that is understandable, right, and that yes, you always want to document your code—that's a best practice—but you want to make it so that the code itself is as straightforward and as lean as possible so that you can really look at it and start to understand what is happening in there.

Yeah, you know, I think there's plenty of people in the past who've predicted that the tech is never going to work and they've all been proven wrong. So I'm a tech optimist on most fronts. I think there's a question of how quickly, right, but there's also a question of what posture do you as a dev team, do you as a company want to take. And I think in general the trust-but-verify approach is right. So if you've decided that there's a certain amount of your code that you're going to write using Copilot or using one of these other generative AI tools out there, if that works for you and it works for your dev teams, then we've got really no objection to that. What we basically say though is everything you're building is an asset for the company. It could be introducing reliability issues, it could be introducing security issues, and what you need to do is make sure that that code is clean. And maybe there's some GPT-X in the future that just 100% produces completely secure, completely reliable code that you don't have to question, but I don't really see that happening anytime in the near future. I think that people are always going to question, they're always going to want to make sure that there's no hallucinations happening that are coming into the code.

One thing that some developers have done using SonarQube, what one of our core products is, build in some rules themselves that check for inclusive language as an example. And this is the type of thing—we've seen all sorts of bad experiments happen with AI where all of a sudden they become racist or they become Nazis or whatever horrible, horrible things. And as a company and as a developer who takes pride in what they're doing, you really want to make sure that if you are outsourcing let's say 10% to an AI assistant or you're getting help on some of your code, that it's actually producing code that you can be proud of. And the pride is that it is inclusive, that it is actually meeting your quality bars, and that it is reliable and it is secure. So we really actually encourage all of the innovation that's happening. It is making developers that I talk to for the most part happier and more productive, because I think a lot of what these tools are doing is taking out a lot of the more mundane work. And to your point earlier, this is an art and a science. It's an art and a science and sometimes it's a slog—it's just work. And if you can kind of get rid of some of the parts that are less enjoyable and focus on the harder parts, that's great. And we think that doing that with this sort of notion of clean code in mind is really the way to go.

There's certainly concerns about this, but I would liken this to what people were saying about cloud back in 2016 when I joined Google Cloud. In those days, oh, you know, there's no bank that would ever use a multi-tenant cloud solution because it just wouldn't possibly be as secure as what they could do in their own data centers, or no one's going to possibly have the scale or sophistication, or you need to customize and things like that. And what happened was that all of the cloud providers—including Google Cloud where I was, but Azure, AWS, etc.—all basically emphasized becoming enterprise-ready. And I think the fact of the matter with all of these coding tools and with generative AI in general is there's a huge demand for enterprise-ready generative AI tools, whether that's for coding, for other purposes. There's more and more companies—I know Google as an example is taking this super seriously, I'm sure OpenAI is, I'm sure Microsoft, Amazon, everyone else is—that they want to make sure that there's the provenance of the training dataset, that you're not scraping a whole bunch of books you don't have rights to and using that to train. So I do think that the industry is likely to solve this moving forward. And again, I think if you are a company that is trying to use these tools, you'd sort of look for what are the enterprise features. And then frankly, what Microsoft did I thought was super helpful with the indemnification they're providing around their generative AI tools—just making it safer and easier for companies to adopt.

You know, I think we really feel like the market is evolving in a way that's perfectly suited for what we do. And I'll tell you a couple of reasons why. One of them is developers over the last—this isn't a new phenomenon—over the last 10 years have really developed a lot more influence and power in how they sort of are able to develop. So the first piece is developer-centric tools are critical. And again, we have 7 million developers who use our platforms today. We have started with a developer, we live and breathe with a developer, our tools are mostly open-source tools that companies can pay to get access to some of the more enterprise features. But fundamentally it is an open-source tool that is built developer-first. So that's point one, and I think that very much plays to where the market is going.

The second—and Marc Andreessen said this back I think in 2010 or something—software is eating the world, but it's continuing to eat the world and AI is now along for the meal. And more and more companies are becoming software companies. I remember a CEO of an auto company telling me a couple years ago that they could build, in his opinion, a car that is better than Tesla, but they could never build software that is better than Tesla's. And that's becoming a real competitive issue for auto companies, it's becoming a real issue for banks, it's becoming a real issue for retailers—every company is realizing it's not just that software is important, it is one of their core assets that they have to build and nurture and maintain. So that's the second trend.

And then the third piece is—I started my career in car manufacturing a long, long, long time ago. And back in those days, the Japanese manufacturers, Toyota in particular, were really eating the lunch of the Ford, GM, Chryslers of the world, because the philosophy that a lot of the American car companies had was build it and then check for quality, and if it doesn't work, get out your hammer and start putting in shims and whatever. That was sort of the way that U.S. manufacturing had evolved. Toyota manufacturing basically said check at every step of the process and figure out if you have a quality issue, stop the line, fix the quality issue, keep going. What we're doing and what I think is the right way to build is you do that as you're coding as well. You clean as you code, you build software that is secure by design, and that is reliable by design. And we think that is the most secure and reliable way to build software. So all those three things together, we think, are the reason why we're here, why developers are adopting us, and why we think we're going to have a great business moving forward.

Yeah, I mean, I think you see this with all of the efforts around low code. I think a lot of the excitement around AI assistants, as I've seen, is that there actually aren't enough developers in the world for a software-centric world. And so more and more people are going to try and develop some code—whether they're going to become developers or not, I don't know—but they're going to try and develop some code. And again, a lot of what we do is clean as you code. It'll help you, it'll nudge you, it will identify issues and opportunities for you, and it will do it in a way that teaches you these things as you code. So we call it learn as you code as well. And it's just at every step in the way, instead of at the end of two days of working on something you get a report of every mistake that you made, it'll actually start to kind of nudge you, almost the way Grammarly does in making you a better writer. Grammarly does it by that annoying red squiggle that appears as you're typing something. We do the same thing but for coding, basically.

Well, it's open source. You can go and download SonarLint right now and start using it, and it will be very eye-opening for you.