Hello and welcome to the Vergecast, the flagship podcast of the world of no sevens. I'm your friend David Pierce. Nilay Patel is here. Hello, Nilay.
So, here's my plan. Here's my plan. We're going to do no sevens in '27.
That's what we're going to do.
So, you had to get all the sevens out of your system at the end of 2020.
We can talk about this at length. I understand every comment on every platform that I am on is people saying you gave it a seven, and I know you and I are going to talk about it because I know you're mad at me.
But I'm just committing right now to no sevens in '27.
And we're going to have to put like a box in the reviews explaining basically every six that we give.
I would have given this a seven, but my boss has this weird thing about this number, so I gave it a six. We're going to do no sevens in '27 and we're going to see how we feel.
Let's just get into it. Go ahead. Bring it on.
Yeah. Okay. We have a lot to do today. There's wild news in the world of server-side app development. We're going to talk about that. There's PHP stuff we got to get into. Like the internet is breaking as we speak. Brendan Carr did a lot of things this week. We have a lot to talk about this week with him.
But we need to come back to the iPhone Duo. The review came out this week. We did a live stream on Wednesday. Thank you to everybody who hung out with us and was there and sent us questions and had comments. It's been super fun to review this thing. It's now been two days since the reviews dropped. We've both, I assume, had a chance to consume lots of coverage. You've seen lots of questions. We've seen all the comments and all the stuff that we've been making. And I think we can boil it down to a few things that have become very controversial about this phone. But we have to start with the score. Nilay Patel, the man of no sevens.
The world of no sevens. This is my phrase. World of no sevens.
If you live in a world of no sevens, what would you give it?
You have walked into your own trap.
I walked into my own trap. I've given a lot of first-generation Apple products a seven. And I think a lot of people have noticed this trend for me.
Okay. The one we have thought about most aggressively in the past was the Vision Pro.
And I got that one wrong.
Flat out. I'm copping to it. I should have given the Vision Pro a six.
Okay, cool. That is a good place to start. I don't know if this is a spoiler you'd rather not talk about, but you went in the course of reviewing this from I think this phone is a six to I think this phone is a seven.
Take me on that journey with you.
It, I mean, this is going to drive a lot of people nuts. So when we first got that phone, the first two days, Allison and I kept saying two things to each other: Boy, this is very Androidy.
Right. In the sort of these ideas are not cohesive and not polished. You can just get yourself twisted into just weird shapes using this phone. Then over the course of the week, one, you get used to it. And two, and this is the one that's going to drive everybody crazy, just a flood of apps got updated the first way.
And I'm calling it the first way on purpose because there's a second important way,
right? Run through the three phases of Duo apps for people who weren't there for the live stream. So, there are three ways apps run on the Duo right now. The first way is the totally unoptimized itty-bitty iPhone app, which is bad.
It's a rectangle floating in black space. It looks right on the inner sort of tablet mode. This is not useful. And then because they have vertically shrunk the apps, they're just not useful on the cover display either. And we can come back to my feelings of the cover display. In fact, we should come back to John Gruber's feelings about the cover display.
Sure. So that's the first way, totally unoptimized. Then there's the second way which improves the experience of using the Duo, which is apps that are updated for iOS 27, and this just makes them a little bit wider but you still get the black bar on the side.
And that black bar on the side is a whole rat's nest of problems. Then there's the last and final way, which is updated for iOS 27.1, which is the Duo-specific version of iOS 27, and that moves the controls over and then you can relayout your app and do all this stuff. And a lot of apps have gotten there and they are still broken. And we're going to talk a lot about the power of vibe coding in this episode when it comes to PHP vulnerabilities that took down lots of websites, but we just have to acknowledge that a bunch of apps are being updated in what can only be described as vibe-coded ways and they're still pretty broken. But over the course of one week, I went from using almost exclusively not-updated apps to at least a little better.
Right. And so during that period, you're like, 'Oh, the experience of using this phone has changed during the time that I'm reviewing this.' Our rule is you review what's right in front of you.
Yep. And that improvement to me was enough to get you from this is a six and you ought to wait to this is a seven, which in my personal worldview means it's fine. It's just fine. And I think that's where I've landed with the Duo. Like if you're excited to spend $2,000 on Apple's first folding phone and live through a bunch of other compromises that we can talk about,
you're going to have fun. And maybe my number one feeling about this review is I looked into the camera in that video three different times and said, 'I'm having fun.' And all the comments from angry people are like, 'Why won't this guy have fun?' And I don't know what to tell you, man. Like, it's fun. It is a fun first-generation product. And I think Allison and I landed on that vibe in our review. I think Joanna landed on that vibe. Marques basically has the same headline as us, which I think his is first-generation fun and ours is like early adopter stuff.
Yeah, that's what it is. It is a fun first-generation product with all of the attendant weirdness of a first-generation product, including the fact that developers don't know what to do with it yet. And so this first wave of optimized apps in many cases is actually like worse. Like Instagram is optimized. It is broken. It is just a broken experience on this phone.
If you have the Dynamic Island open on the cover, like I was in an Uber on the way home last night and it has a little Dynamic Island widget and that scoots all of the system UI down and just covers up the Instagram UI.
Like they just did not account for this happening. And so they'll fix it. On what timeline will they fix it now that they've shipped the first very clearly sort of auto-relaid-out app? I don't know.
Google is the laziest of all the companies in the world and Gmail on this thing is like it's just a hilariously thoughtless exercise in optimizing for the Duo.
Yeah, I would put the over/under for Google updates its apps for the Duo at like a year and I think I'm probably taking the over.
But they've all been updated to the middle ground. Like YouTube isn't upgraded in the middle ground. YouTube TV is updated in the middle ground. Gmail is upgraded in the middle ground. They're just not good yet,
right? I think a lot of companies will be very happy being in the middle ground. They'll be like, 'Look, it fills up the space. The end.'
And you're like, 'Okay, so in a year some companies will feel shame and they will have done a good job,' right?
And this is all I mean, like you got to review what's in the box. And so at the very beginning it was fully the experience of using this phone was little tiny iPhone apps and a not useful cover screen. And by the end it was a not useful cover screen, little tiny iPhone apps and at least something a little bit better on the inner screen.
And that to me was like, okay, you get one point back. All of that logic makes sense to me. I just cannot get past the fact that a, this thing costs $2,000.
This is not like an adorable first try at a thing. Maybe it's $2,000. And also, it's called an iPhone. Like, I said this on Wednesday's live stream, but if Apple had actually pitched this like an entirely new category of device, I would be so much more willing to put up with a lot of weird new bad ideas about how things work.
But they're calling it an iPhone and they are going to try to sell it to people who are just trying to buy iPhones. They keep talking about how it is an iPhone. And I just, I want to give a company like Apple lots of license to innovate and try new things. We give them a lot of crap for not doing those things. And so when there is opportunity and reason to go try new stuff, I think that rocks and I think you get lots of leeway to go try new things. I just don't think you can look at this and say for a product called iPhone that is going to be sold in stores next to all the other iPhones to hundreds of millions of people around the world that this is a good product for almost any of those people because it isn't. It might be. I think the thing that I'm most excited about about the Duo is there is such a straight line from this to the second or third one being awesome.
And I was not sure that that was the case. I think a lot of people are upset with our review for not pointing at that more.
Sure, but we again, we only review the products that exist. If we reviewed the future, every review would be a 10 out of 10. Like that's not how it works. But I really, I think in a way that with the early days of like the Samsung foldables, it was not obvious how this thing goes from this to awesome. I think that path with the Duo is obvious. There's a lot of things to do and Apple has to rely on a lot of third-party developers to do it and those third-party developers are constantly given more stuff to do and having more things taken away from them by Apple. So like that is not a guaranteed thing but it's coming there. But this thing is too expensive and not good enough and I just don't know how you give that a seven.
Sure, in the context of expensive it is definitely more expensive than the other phones. It's slightly more expensive than its peer foldables. So fine. I think it's as expensive as it is so more people don't buy it. I think it is priced very deliberately, right? It isn't.
You're not reviewing Apple's economic strategy.
Well, I'm just saying like the iPhone X was also the more expensive iPhone at the time and it was not meant for everyone to buy. Like they limited the amount they would have to make at the price point. I agree with you that as an iPhone, it is not the best iPhone. And right, the best iPhone right now is the iPhone 18 Pro or the Pro Max.
Yeah, but it's right there. You can just buy the best iPhone if that's what you want.
Like we should talk about like Gruber's review and we should talk about Marques's review. They both landed on a line that I wish I had stolen. I think Marques was much nicer than John. He was like, 'Do you want a kick-ass OLED iPad that folds? You can buy one now, but it's not an iPhone.' Like he's talking about an iPad, right?
John was like, 'This is the worst iPhone that has ever been made.' He referred to it as a miserable fat little thing. Which is just an incredible line.
And he's totally right. Right. So if you just... And John later in his review was like, 'This is the best iPad ever made. It's better than the iPad. The multitasking is more rational. It makes more sense.' I have feelings about that. But you will note that both of those perspectives are this is less an iPhone and more an iPad. This thing represents the future.
What's the name of the product?
This is, I'm agreeing with you. I'm just pointing out that our friends and sometimes rivals got to the exact point that you're getting at.
It is a fun hypothetical actually. If Apple was selling this thing as the iPad Duo and you could buy it as a Wi-Fi only or as the like tethered thing that Apple does with the iPads and there was absolutely no pretense that you might buy this and use it as your primary computing device which is what a smartphone is, we might be talking about this radically differently.
This would be easily the best iPad ever made. It would be, you would just think about it as a full reboot of the iPad. Yeah. That had a little cover screen and it would be crazy expensive and everyone would say, 'I wish this could just be my phone.' And then we would have Apple.
They should have just called it the Apple Duo. They should have just called it the Duo.
The problem is they ran away from the iPad and maybe for good reason. Like I didn't get too much into is the iPad a success. John just put a knife through the heart of the iPad in his review. Like Gruber was like, 'The iPad sucks. Its multitasking is stupid. Everyone who was involved in its first version of multitasking should feel shame and maybe never work at Apple again.' Like he is mad at this thing. And he and I, you know, we text a little bit. He, you know, Gruber's entire approach to reviews of Apple products is to hold them to the highest possible standard.
Are they perfect or do they exude the amount of consideration that Apple typically is famous for? And lately, I think he's been like, 'Nope.'
Right. Like John's approach to liquid glass is like, Alan should never leave the planet.
Yeah. I encourage everyone to go read the posts that John put out when Alan left Apple to go to Meta and how he felt about what that even just the addition by subtraction might mean for Apple's design.
You know, I think John was very harsh on the Siri AI debacle because it meant that Apple wasn't making its own products as well as they should. So that perspective applied to this product is fascinating to me because he's like they didn't actually solve the problems and the lead of his review is here are all the questions you might have had about Apple's first foldable and then you would be like what did Apple do like how did they horsepower their way out of it and then his reveal is like they didn't, right? And but he did get to this is an improvement over the iPad by throwing out the baggage of the iPad and thinking of multitasking in this way you get to a better smarter place where you essentially have two little phones. Okay, that's something.
Yeah, I don't know that I agree with that take, but I see where that take comes from.
I mean, that's like if you think about it as a Duo where the outside is an iPhone and the inside is an iPad. He's like, they took the opportunity to rethink the iPad and they got to something better and they did not take the opportunity to make a good phone. They made the worst iPhone ever made. That is his view. I do not 100% agree with that. I think there have been worse iPhones. The iPhone 5C I think was a worse iPhone than this one.
Unapologetically plastic if you will recall.
The open circle back case. Those were the days.
Yeah, there were just some weird iPhones in the past that you could litigate what was the worst iPhone. I think this one is too small. I think we have to concede that all of the small iPhones did not succeed in the market. There's a reason Apple doesn't make them, is because people want big phones and developers have responded to that by making big apps.
And so now you have a tiny phone. You have a phone that the market wholeheartedly rejected and then you have an iPad and that I just keep coming back to like the outer screen is not very useful. The inner screen could be wonderful. I want a matte display OLED iPad that folds up and goes in my pocket. That thing rules.
It does look great. Like the experience of like I was thinking about this this morning actually that like one fun test for something like the Duo is just if I opened it up, put a full-screen video on it and handed it to you, what would your reaction be? And I think overwhelmingly the reaction would be wildly positive. Like the screen looks great. It feels good to hold. It's the right size and that like they did that part extremely extremely correctly.
I was on a Google Meet, is not optimized for this thing. And I was on a Google Meet call with a bunch of people the other day in the back of a car and I was like, 'Oh, this is the future.'
I pulled out a little sheet of glass from my pocket, unfolded it, and took a video call.
I had it. I was... You don't join video calls from the back of the car. I don't have the camera on. No, no, no. That's very rude.
No, no, no. That, no thank you.
Nilay does not allow his whereabouts to be known.
I just think it's rude. I think if you're like, 'I'm joining this call from a moving car,' you just keep your camera off and you keep yourself on mute unless you have something very specific to add.
But you've taken yourself out, but the camera's on the front of the display. Like that works fine for that task.
But there's something that is like legitimately cool. And everybody who's had any foldable in the past is saying, 'Yep, it's always been cool. It's been cool for like eight years now.'
Okay. Like all that is true. There's a reason in Android world foldables have not eaten the market. It's because they also contain these compromises. They are also more expensive and you have to decide whether you want a great phone on the outside and a compromised tablet on the inside or a compromised phone on the outside and a great tablet on the inside. And here Apple just picked the weirdest of all worlds.
Yeah. Well, and I also think Apple, the reason the app situation is so frustrating and I'm both sensitive to the thesis that not very long from now this app situation will be much less of a problem. I think that is probably true. Apple is very good at getting developers on board. But with something like this, Apple's main success over Android is that it has cohesion in its software, right? Like Apple is unusually set up to make all of this make sense. And Apple couldn't even do it with its own software. Like some of Apple's apps look great in Duo optimization land. Some of them look like butts. None of them know what to do with the outer screen. So, you look at this and it's like, I'm not even sure Apple has a whole idea about how this software is supposed to work. And Apple's whole advantage here is that it has that idea and is able to communicate it to its developers in a way that they follow. Like, like or hate liquid glass, liquid glass is now everywhere. And that is, there is something powerful about that, especially next to Android, which is just a big jumble of a thousand ideas.
Yes, Apple can enforce a bad decision at scale is a real thing. Look, they're putting out a label this week in the App Store that says made for iPhone Duo, and we'll just point out that that is straightforwardly a Google Play Store idea.
This is also, this is the most admission of failure as a developer platform that you could possibly imagine. Like,
Oh, I don't think that's true at all. Come on.
Apple's whole thing is like these apps just work. You can run them all everywhere. Don't even worry about it. And now it's literally going to be... they have a fancy new phone and this is the most any iPhone owner is going to go look for new apps in the past five years.
And they have a little badge to incentivize developers to get in that game. This might be the last time anyone does apps forever because Muse is just going to run Linux for you in the background hacking PHP. Let me actually, let me put that in front of you. I've been thinking about this a lot. For better or worse, Apple just caused a week-long panic about whether iOS apps would be optimized for its new hardware.
Sure, that idea is right next to maybe there will never be apps again and you're just going to talk to a Tamagotchi that uses Linux in the cloud on your behalf and everything will be headless and what are we even doing here and there's a new platform.
These ideas are running away from each other.
Mhm. And I think app developers are much happier about we're going to make a weird tablet app and maybe you'll use our app than they are about Claude, what's the duet, Claude Duet is going to come use our website and human beings won't even see it.
Oh, I agree and I think again I am actually optimistic for the future of the Duo because again it looks like it's been a hit. People are excited about it. Crucially, techie people are excited about it. It is not actually going to suffer some of the challenges that other Apple devices have, which is that the right group of people, which is people like app developers, have not been super psyched about having this device, so they don't build for this device. And you don't get that app flywheel. Every developer I know has been goofing around in the simulator for a while. They all complain about how slow the simulator has been for the Duo, but they've all been using it. Everybody's excited to update. They all have ideas about how this stuff is going to work. Like I think the App Store situation will get better fast. This is why I'm not mad at the App Store. I'm mad at you because you reviewed the thing in the box and none of that is there yet.
They went from six to seven over the course of one week. That's all I'm saying. And maybe over the course of the next six months it's going to go from seven to nine. I doubt it because the phone's still going to get hot and if you use the inner display a lot, the battery is going to die faster. And I think the camera is not as good. And if you use the camera a lot, it definitely gets hot. Like the Touch ID is a compromise. There's already reports this week from Germany that Apple's working on Face ID.
Which is just an incredible way to tank sales of the first-generation device.
I mean, the thing is compromised. It's a compromised first generation. It's heavy. App support could help the experience of it out of the box go from six to seven. Seven to nine is not going to happen because more apps get optimized. Do you know what I mean?
Yeah, I think I probably agree with that. But I'm just so stuck on the idea that like right now a lot of people bought this phone. I think more people than we expected, more people than Apple expected pre-ordered this phone such that stuff is backed all the way up to January and February,
but the dates are moving up.
They are moving up, which has been really interesting. I've seen a lot of people who were like, I expected my phone to come in December and I just got the 'it shipped' message. I actually don't know what to make of that, but it does seem like Apple...
Greg Jozwiak is turning the knobs on perceived demand.
Yeah, he like hit the make more of them button like factory line go faster. That's how manufacturing works, right?
We got to get, they got to book the sales in Q4, man. You know,
I guess. But a lot of those people are going to get a phone in the mail. They're going to open it up. They're going to turn it on and it is going to be confusing as all hell for a while. It just is like it is going to be a frustrating experience. And if your argument is that these people are self-selecting because they're buying a thing that is first generation and is $2,000, that's fine. By the way, that is my entire review. That is the conclusion of my review. If you want to have that experience, if you, like me, find it somewhat fun to be frustrated by new ideas about smartphones, you're going to love this thing. You're going to have the time of your life. I think a lot of people bought this phone predicated on the idea that Apple figured it out. And I don't think there's any evidence anywhere in this device that Apple has figured it out. Not in the hardware, not in the software, nobody. But like the whole pitch, the whole message coming out of Apple has been we're six years late to this party, but we did it. And they didn't yet. They might.
No, they might. They genuinely might.
Because the way they could have nailed it is if it was an iPhone on the outside and an iPad on the inside. And they just didn't do that.
You know what's funny? Do you remember last year when the iPhone Air came out and everybody was like, 'Oh, the obvious future of this device is they're just going to stick two of them together and that's the iPhone.' They probably should have just done that. That might have been the answer.
Yeah. I mean, I think again I think the aspect ratio, to quote my friend John Gruber, a miserable fat little thing. Just one of the all-time harshest burns from anyone in any product review. But that size and shape for the cover screen I think will not last. It might last a generation or two, but I don't think it's the right one. And I think it is inevitable that this device crashes into the iPad. And it might be that the iPad steals more from the Duo than the Duo steals from the iPad, but these things are going to run into each other.
What was your line that this wants to be an iPad the way the iPad wants to be a Mac?
The iPhone Duo wants to be an iPad the exact way that an iPad wants to be a Mac. You know, when you use an iPad, you can just see over the fence into what it would be like if it was a Mac.
And then you're like, 'Screw it. I got to just use my Mac.' When you use an iPhone Duo, you can just see over the fence into what if this was just an iPad.
And then somewhat importantly, I do not then go use my iPad.
I just go use my Mac. Skip straight to the Mac. But a lot of people do use their iPad. Yeah. I think the way that that goes that could be really interesting is if the iPad stays on the current trajectory, which is just to be increasingly Mac-like. Like it is just running right into the Mac. And the Mac sort of runs back towards the iPad if we're going to get a touchscreen Mac as soon as next week. This is going to be a just true collision of two different kinds of devices that maybe Apple is starting to accept are for all intents and purposes the same thing. We'll see. But those two things seem to be running at each other. What that leaves is this giant gap in the middle, right? The third thing Steve Jobs always talked about. And maybe Apple's new idea is that actually the Duo can occupy both of those spaces. I disagree with both you and Gruber that this thing is a perfect iPad. You've both used it way more than I have, but we talked about this on Wednesday, like this thing doesn't run iPad apps, and it should. There's a bunch of apps that don't exist because of that. And there's also a bunch of apps that will never make sense on a screen this large unless they are functionally or actually iPad apps.
Completely agree. This is what I'm saying. Like it's not an iPad. I think everyone assumes that you have an iPhone that unfolds into an iPad.
It is what you... It's the only natural assumption and it is not that thing.
No, it's an iPhone that unfolds into a bigger iPhone.
And I think people are going to look at a touchscreen Mac and assume it is an iPad. Like I honestly think Apple is in a period of like intense soul-searching. The idea that they're going to come out with jewel-like products that perfectly split the difference and solve, you know, like look at all these hardware keyboards on these stupid BlackBerrys. Here's an innovation that just outdoes them all, right? And that's going to change the paradigm. I think Apple is actively like looking for those new ideas while the idea that AI is the next great interface platform or interface paradigm just like looms over them.
Yes. Right. Like you're going to talk to Siri AI and it's going to use the apps on your phone on your behalf is not a thing that exists in Apple world yet. It might be the thing that everyone else is chasing.
Yes. And I think in a funny way Apple allowed itself to get sort of lost in the sauce of AR and VR in the same way that Meta did. Not quite to the same extent. Nobody's worried about legs at Apple Park, but Apple, I mean you think about even something like liquid glass, right? Like that starts from the idea of the Vision Pro and it starts with this idea that we are going to mesh the digital and physical worlds. The Duo has none of that pretense, right? Like this is new questions about digital software and I think Apple is going to have to pull itself back into array in some ways around what devices do we actually make and what do people actually use them for.
Yeah, I think this is good, by the way, just to put this out there. I think that it's good for Apple to be in the 'what if we tried this' mode. They haven't been in 1,000 years.
And you know, the Tim Cook era at Apple is dominated by it's an iPhone and we're going to make 60 SKUs at every price point and everyone in the world will have them and our supply chain efficiency will be unmatched and the software will get worse over time. Like there's no getting around it and we're going to wage a bunch of European regulatory battles or whatever. And I think that has made people forget by the way that Apple even when it was a huge company still tried things. Apple has failed a lot and they have relentlessly tried things.
Steve Jobs launched a social network inside of iTunes.
Yeah. And like I think that rocks like it is I genuinely am thrilled that the Duo exists. I think it's fun and interesting for all the reasons that you do. I just don't think...
You just think it should be $500.
I just don't think I can look anyone in the face and say you should buy this phone. And if that is...
But just to be 100% clear, it's a seven out of 10 because if you are like I will spend $2,000, I don't think it's going to explode in your face, you're just going to be like this cover screen's a little bit small and these apps are pretty weird on the inner screen and the team at Meta allowed Claude to update Instagram and I hope they allow Claude to try a little bit harder next time.
Yeah, they got to update to the Pro plan. They don't then I mean like look Instagram Edits the video editing app like that team did a great job. The main Instagram app I do not think they did a great job.
YouTube just you know like does Google have a bunch of AI coding tools? Like I'm making this accusation somewhat in jest. I assume someone tried, but I'm also just aware that we live in the age of vibe coding and this is a thing that will be happening to people that use app code. So there's that, but the things that you will actually complain about as a first-generation early adopter. The phone does get hot, especially if you run the camera with the screens on. It gets hot if you stream a bunch of video. I watch YouTube TV every morning. I watch CNBC every morning I get ready and it gets hot when you do that. That's just a thing that happens.
Is that Google's fault? Is it Apple's fault? I don't know. The phone gets hot when I do a thing that I do with my other phone all the time. That you know if you use it open a lot, you're using in tablet mode and if you have brightness ramped up, you're going to drain the battery. Like these are the things that are going to happen with this phone.
That's early adopter stuff. Touch ID is going to annoy you.
Early adopter stuff. The next generation might be great. The third generation might just be the iPhone.
Yeah. And that's what I mean. The thing that I am most excited about about the Duo is you can see that path and I think there is a real chance that this ends up being the iPhone. Like I think that's exactly the right way to put it. It's certainly not now and it's not even competitive with the iPhone in that sense, right? Like it is such a radically different thing that you actually shouldn't even comparison shop this versus another iPhone.
Until, and by the way the other reason is that Handoff is not ready. And we touched on this briefly in the live stream. It's worth saying again now. I know a lot of people who assumed they could keep their existing iPhone and then buy a Duo and use this new Handoff feature where your eSIM seamlessly is active on both phones and just goes into active mode depending on which one you're using it.
That only works on T-Mobile. You have to pay extra money for it and it doesn't transfer your Apple Watch,
right? So you or your Whoop band or any other sort of like hardware device that thinks it's connected to your phone, signal does not go back and forth automatically.
So it's like the glimmer of how that will work in the future.
But the reality is it doesn't actually work right now. Like Handoff works. It'll move a phone line back and forth. But the iPhone is not built to be multi-device in that way, right?
And so that needs another year of refinement as well.
So interesting idea. Doesn't really work. Needs a year of refinement. Seven out of 10. Neither...
Because you're going to have a good time. If that's the experience you want, do I want to go on this adventure?
This is like saying you shouldn't buy a Corvette as a daily driver.
But people who buy Corvettes are very happy that they have Corvettes.
Sure. They don't, crucially they don't call the Corvette the Camry Plus.
The Camry Duo. The Camry Duo.
It's because it has more exhaust. So that's how you know.
That's true. All right. If that's your objection, I will go revise the score. I'm going to change this to that they should have called this the Corvette.
I'm telling you, the world in which they talk about this thing as an iPad is a truly fascinating parallel universe to me. We should get off this subject because we have something just as sexy to talk about, which is server-side application technology. The internet is breaking, people, and we need to talk about it. We'll be right back.
Support for the show comes from IDRA by Palo Alto Networks. Every new cloud workload or AI agent your team sends out is another identity that gets permanent access to your systems. And in 2026, those non-human identities with access outnumber actual human identities 109 to one. You need a tool built to manage them all: human, machine, and AI. That's exactly what IDRA by Palo Alto Networks was designed to do. It's one identity platform for all and it outshines legacy tools that were only built to manage human employees. How does it work? Well, IDRA replaces permanent permissions with dynamic access. So, you can lock down every identity without slowing down your own business. With IDRA, you get unified control by replacing siloed IAM, or identity and access management, PAM, modern privilege access management, and governance tools, all with a single control plane. And it does that across human, machine, and AI identities. Secure every identity at your organization with IDRA by Palo Alto Networks. Learn more at paloaltonetworks.com/idra. Again, that's paloaltonetworks.com/idra.
Support for the show comes from Bitwarden. October is Cybersecurity Awareness Month. And here's an upgrade that actually gives you something back: time. With fewer password resets, less typing thanks to autofill, and no more trying to remember which variation of your dog's name you used this time. Bitwarden is the trusted open-source solution for passkey, password, and secrets management. It makes secure password management available to everyone with a free-forever plan for individuals. That way, all users have a reliable way to create, manage, and autofill strong and unique passwords across accounts and devices. Bitwarden uses end-to-end encryption to protect vault data while secure autofill helps reduce phishing risk by matching credentials to the right sites, giving users greater peace of mind when logging in. Bitwarden is trusted by over 15 million users and 80,000 businesses across 180 countries and 50-plus languages. Get started with a basic free plan for individuals or protect your business today with a free trial. This Cybersecurity Awareness Month, check out Bitwarden. Visit bitwarden.com to get started.
All right, we're back. It's been a very strange 48 hours in the world of web technology, and it has done the thing that sometimes we like to do on this show, which is take all the parts of the internet and computers and the world that no one should ever have to think about and brought them right into the forefront of everyone's lives. Nilay, do you want to try to explain what's going on with PHP shell or do you want me to try to do it?
I'm just going to say what the prompt was that caused the global internet catastrophe that we faced yesterday.
Wait, I don't actually know this.
Okay, so David's going to tell you a long story about AI being used to find vulnerabilities in PHP, which is a load-bearing piece of technology that runs a lot of websites. But I'm going to tell you that the prompt that the security researcher used was just 'find bad vulnerabilities in PHP.' That's it. That's it.
Oh my god. You know this makes me think of, have you ever seen that meme where it's like the bell curve and at the beginning it's Apple Notes and then at the top it's like everybody's super complicated productivity systems and then at the end it's just Apple Notes again.
That's AI again. Like remember when everybody was like here's how you have to set up your CLAUDE.md and you have to have a folder full of markdown files and you have to do all this stuff and then the models got one step better and now all you have to do is type 'find bad vulnerabilities in PHP' and it breaks the internet forever.
Everyone had all these like complicated CLAUDE.md files or whatever and now it's like just I don't know.
Yeah, just type one lowercase sentence. It'll probably be fine. So okay, so let me try and explain just very basically what's happening here. So, PHP is software that runs on servers to create web apps. That's sort of the simplest way I can think to explain it. Apps run on servers...
versions of software. PHP is the one that runs on the servers in order to make them dynamic. Um, it's uh bad as a programming language. A thing I've discovered over the last couple of days is every developer who has been forced to work with PHP in some way or another thinks it is a crappy, unhelpful, sort of chaotic programming language, but everybody is sort of forced to use it because it is so structurally important to the way that the internet works, to the point that I've seen estimates as high as 70% of the websites on the internet use PHP in some way. And importantly, PHP is underlying technology. So lots of apps, lots of CMSs, WordPress runs on top of PHP, like it is deep, deep down in the infrastructure of the internet. And this organization called Whiz Research, which is just a fabulous name for research. I assume they used to be into TouchWiz on Samsung devices and now they've pivoted to AI. Um, they found these vulnerabilities in PHP, and crucially in PHP itself, right? This underlying technology way below all the apps. It doesn't matter what app you're running. It doesn't matter what website you're on. It is in part of the base layer of technology that does this. And like Neil said, they used AI to find these vulnerabilities by typing 'find bad vulnerabilities in PHP.'
I will say there's a little bit of complexity in like who found what when. There was an embargo. There's a second company that independently found the vulnerabilities with the prompt, but they're the ones who released the fixes early and it caused a panic in the scene. But it is true that the prompt was 'find bad vulnerabilities in PHP.' Yes.
And basically these vulnerabilities are there, there's several of them and they're each very specific, but basically the overarching idea is that they are related to what happens when a process runs out of memory. So you, the computer asks PHP to do something, it fails for an unexpected reason, and essentially there are a lot of people who know this stuff better than I do who are going to yell at me about this, but it basically leaves a hole rather than finishing the process. It just sort of disappears and it leaves a hole that if you are there as an attacker at the right time with the right tools, you can just exploit. And what you can do if you get in is just anything you want. You don't have to have administrator access. You don't have to do anything. You have core access to all of the data, all of the code. You can execute your own code inside of this. So it's like if you are there at the right place in time, you have just absolute complete control over anything running PHP.
We have known about this exploit for a couple of years and there have actually been people talking about this thing for some time. But what was really different about the world a couple of years ago was that if you wanted to engineer a hack on a website, you basically had to do it manually. And because this is a very specific thing that only happens in very specific circumstances, the idea that you were going to do this at all and at any kind of scale was just sort of impossible, right? You'd need a giant army of people individually attacking websites over and over and over and over and over and over again, hoping to land on this one particular instance in which you can take over the website entirely.
But you don't need all of those people when you can just set an army of AI agents out into the world with instructions to go looking for these things and keep pounding on them until they hit the jackpot. And that's essentially what is able to happen now. So it was GPT 5.6 Soul and the new Gemini 4 Argon were both used in service of both discovering and in theory starting to fix this exploit. But they were basically able to go out and find that, okay, now automatically this is doable at scale, simply, quickly, and automatically, and anyone who wants to can just force their way into vast swaths of the internet.
Yep. Is that a reasonably good explanation of what's going on? It is. The complication, and I think this is just a fascinating element here, is you know there's an entire process and etiquette around disclosing security vulnerabilities, and so the first group of researchers found the vulnerabilities, they were on their way to publishing them, and it's the second company, Chainuard, that heard that this was going to happen, did the AI prompt 'find bad vulnerabilities in PHP,' and released fixes before the embargo on the vulnerability.
Ah, so this set off this like crisis panic of this was released before we were ready for it. You know, they're apologizing for it, but they're trying to explain what they're doing. But what just really struck me about this is that there was like a whisper on the wind that there was a PHP vulnerability and someone else was able to go find it, right? Because you don't need a sophisticated security researcher who's about to disclose a secret. You need an AI model and say, 'Hey, can you go find some vulnerabilities, right?' And then you'll find substantially the same ones.
And that is the dynamic here that is to me just new. There's not another world where you hear that someone else has done something very complicated and then you're like, I will frontrun them by doing something equally complicated. Yeah. But the price of doing that just came way down.
Yeah. We've been covering the AI math wars recently. And that's very much the same kind of thing. It's like, oh, there's rumblings on Twitter that someone has solved one of the Millennium Prizes. Let me just sick a bunch of agents on it until they figure out which one it is and try to get there first because all of a sudden we've discovered there is something new to know here. And as soon as you know what direction to point these systems in, they are very powerful in running as far down that direction as anyone ever has before. And so the speed of this I think has caught a lot of people off guard. So on Wednesday they disclosed this publicly. It's a huge thing because the recommendation from the PHP maintainers is essentially, you need to update your web stack as soon as humanly possible. We have a fix. We can fix it. You need to install it this minute. And if for some reason you can't, the safest thing to do is go offline. That's their other recommendation is you have to get your website offline until you can fix this. That's how serious and accessible this vulnerability is. So all over Europe in particular, like I was reading in the Netherlands, a huge amount of government websites were going down. There were a lot of public government sites in Finland and in other countries that just were like, it's going to take us some time to fix this. Ancient infrastructure in every government is a thing. These things are not as easy as a software update on your phone. So a lot of folks were just like, the simplest, safest thing for us to do is just go offline. Wikipedia has had trouble with this. The Internet Archive was briefly offline. Like the actual ramifications for this have just been huge. Even as everybody who is incentivized to tell you nothing has gone wrong has continued to tell you some nothing has gone wrong. OpenAI came out and said something to the effect of like, the AI found the problem before attackers did. So that's good. But then Amazon was kind of like, well, that actually doesn't seem like it's true. They have some evidence that the hackers got a four-day head start. Matthew Prince, the CEO of Cloudflare, has said they've already seen millions of attempts to exploit this. It's just out there now. Like this swirl has started. And because it is so much easier to exploit because all you have to do is type that stupid prompt into ChatGPT, it's just like the toothpaste comes out of the tube and it is very, very hard to create this incredible worldwide effort to patch 70% of the web all at once.
Yeah. Bill Gates on Decoder, I would say, was not a hopeful message from the co-founder of Microsoft. He was like, we're in for 20 years of pain. Like that was basically his point. And he's like, 'But we should do something about it.' And I asked him, 'Does something really bad have to happen first?' And he was like, 'Maybe.' Like that's how we handle other disasters. And one of, you know, and I tried to ask him if like AI was conscious, you know, like these high-minded Decoder questions, and he was like, 'Who cares? The problem is now, deal with that later.' Like answer, by the way, shouts to Bill Gates for correctly answering that question.
He was very much like, 'Shut up, Nilay.' Talking to Gates is very much like if he thinks you're smart, he will make it also clear that he is much smarter than you.
So it's like a compliment that he spent an hour and 10 minutes with me. And also at the end of it, I was like, I just got punched in the face. But the vibe is everything is going to get so much more insecure before it hopefully gets more secure than ever, and we are about to live through the it gets way more insecure. And even this back and forth about when to release fixes, you know, the company that released the fixes early before the embargo broke, their rationale was we are seeing it being exploited. Like a couple days might be too many days of this being in the wild because it's out there.
Yeah. And so there's just something here where even the people who are the most anti-AI deploy tools to fix a lot of code.
Yes. Right. And one of the bigger sort of existential questions if you're on like the good guy side is you probably need your defensive AI to be autonomous as well because the bad guys are going to have autonomous AI looking for vulnerabilities all day and all night. And finding new ones. And if they can show up on your front door and do something bad and you have to put a human in the loop, it is probably too slow.
Yeah, I think that's right. I mean, this to me rhymes so much with the OpenAI Hugging Face hack in that this is the sort of thing people have theoretically thought about for a long time, right? It seemed obvious that eventually it would get good enough at breaking into these systems that we would have this forever arms race between offensive AI and defensive AI. And that is just what this is. This is that made manifest in a really big way right out of the gate. And I suspect if it is like the Hugging Face incident, we are going to hear about a lot of these again very quickly. And this one was directed, right? It's important to note that somebody asked the tool to do this, but we are not a lot of turns away from being able to just set agents out looking for vulnerabilities.
Right. 'Go find bad vulnerabilities in PHP and go get me some crypto' is right there. Yeah. Right. I don't think that's even out of the realm of today. Like I'm confident that is what attackers are going after today. The question is whether we have built the control systems or the alignment systems or whatever to let the defensive agents run around our code bases and fix them or look for vulnerabilities and ward them off. And I don't think anybody has landed on that answer correctly. We've landed at take the Internet Archive offline for a few days.
Right. Yeah. The only answer is literally turn your computer off. Don't let the AI in. So right next to this, I know you want to talk about the broader web. So this is the PHP story. This story, we're going to tell a version of the story for the next couple years. It feels very much like whatever the framework of this story is, we're going to repeat it. It's the hero's journey only it's PHP vulnerabilities. Mhm. At the end, you know, it was really the friends we made along the way. And that friend was PHP.
Right next to that is basically the web breaking through attacks by products that are being used legitimately through the front door. Uhhuh. Right. So like Mia on our team this week, she set up an agent to just hold products on The RealReal, which is a fashion resell site, and she just had Muse find some products, hold them for 20 minutes, which is as long as you're allowed to hold them, then drop them, and then hold them again, and then did it again. And she's like, I basically locked these products up for hours.
I can just keep it in the cart over and over and over.
Keep it in the cart. And The RealReal is like, you know, the whole point of that is to impose some friction. So if you don't buy, someone else can. And I was like, this agent is letting me do this. Like Muse just did this. Who should stop her? Someone should stop Mia is what I'm saying. Always. Yes. Who should Muse not do that? Is that an alignment problem? Is that a safety problem? It's your agent. If you were to do that as a human, you'd just be a jerk, but you could do it. Should The RealReal detect Muse and block it the way that a bunch of banks are blocking it?
Well, I was gonna say that's again that is very much in the just take your website offline answer, right? Because the one tool these sites have is to block the system entirely. There is no way of working together that makes all of this okay. There is... well, so you block them to get terms. We've seen a lot of publishers do this, right? They block whatever AI system, OpenAI, whatever, and then the AI companies are sad and then you're like, 'We'll do a deal.' And like every publisher, I'm not even sure if our deal survived the transition to BMC. Yeah. I'm confident our parent company has a deal with someone. It no longer is relevant to us presumably, but like Amazon is out here blocking not for deals. Amazon is saying we want no part of this game. But I think that they're going to end up with deals. We want no part of this game until the rest of the market has settled down and all of you realize you still need Amazon and then you will come crawling up to us, right? Like I think that's true. On the flip side, Walmart is basically saying, 'Let your agents come shop with us.' Yeah. We will take over for Amazon, right? Because Walmart also has a giant third-party marketplace and fulfillment centers and all that stuff. And so if they can take points of share away from Amazon for agent commerce, then that's gonna be great for Walmart. Yeah. But like all of this is just deals. Like the idea that your agent is just you going off and doing things on the internet was very tempting for five minutes at the beginning of all this and it is absolutely not going to be true. They're going to be opaque backroom deals that control how the web works because all that money is too lucrative for this just to be wide open.
Right? And I think the shopping cart example is a good one, right? Because there's a way of looking at this that says, 'Okay, I should be able to buy something from Amazon.' And the fact that Amazon's website is so bad, I don't want to use it, is actually Amazon's problem and not mine. So bypassing it is something I can do with no hard feelings. But like what Mia did with The RealReal is actively shady stuff and it's the kind of thing a human not even maybe could but just wouldn't do.
I think lots of people camp on their carts on various platforms.
Sure. But it takes work, right? And like the friction ends up being really important there. It's like I think a good example of this is Ticketmaster scammers, right? As this stuff has gotten more automatic, it's become a much bigger problem because it's one thing to sit here with a bunch of computers and all of my friends and try to buy Taylor Swift tickets. It's very different to send an army of bots at Ticketmaster to reserve all of the Taylor Swift tickets. Like we're now, we are no longer playing a fair game anymore in any sense of the word.
The entire internet just looks like more and less illegal DDoS attacks.
Yeah. Yeah. And I think the question for The RealReal is like, okay, are we even letting human shoppers do human things just with a new tool? And I think the answer in so many of these cases is going to be no. People are going to try to do things they wouldn't feasibly do themselves.
All right, let me throw this data point at you. Okay, so Meta had earnings this week. They did great. Meta's going to make it out a quarter, you guys. But the most important part was that they confirmed estimates from earlier that Muse has more than 10 million users. Mhm. And Zuck said 25% of people who set up Muse now use it daily, which is either good or bad. We should talk about that. That's people. And he said a quarter of engaged users who were shopping, which is interesting. A quarter of the users who were shopping, Mhm, unclear how many people that actually is, but a quarter of the users who are shopping have an average purchase size of over $200.
Then he said... big number. And he said Plaid, which is, you know, the connector to the banks, and Stripe had to do work to account for that demand. Wow, that's a big number. Or a small number because not a lot of people are shopping. It's a quarter of the people who are shopping have purchase size over 200.
Well, sure. The idea that I'm going to let Muse spend $200 for me is just not in the realm of possibility. But you have given Muse your credit card and let it buy you movie tickets, which I think is dangerous and irresponsible. But you live on the edge.
My best Muse experience so far, other than the time it almost bought me a car, was this Monday when I was in New York. I had a very brief period of time away from my children and thus allowed to do things in the evening and I was like, I want to go see You Can See Everything. So I did what you do when you want to see You Can See Everything, which is I went to Fandango and looked at a bunch of things. I went to the Alamo's website and I looked at a bunch of things. I looked at maybe a hundred showings and everything was sold out except the occasional front row seat, which I was warned for a variety of filmmaking choices reasons you should not do. Do not sit in the front row. You Can See Everything, I promise. So I just went to Muse and I said, 'Hey, I need one seat somewhere in Manhattan. Here's where our office is. The closer the better. Go find me a movie ticket.' And it did. It found me literally what it said and what I believe was the last single movie seat in Manhattan for that day and it bought it for me. It had access to my credit card through Link, which I think is a Stripe product. Sure. And it bought me a ticket and it sent me the confirmation from Alamo Drafthouse to my email. It was the most remarkable experience I have had. And I still had this conflicting feeling of like, okay, well, it found me something that I wouldn't have found otherwise. I tried to do the manual labor to find this movie ticket and could not. And it found it for me and that's great. But also, if it's one of those like, if you just imagine everyone is doing the same thing that I am, if everyone did that, it would all collapse.
