From zero to NanoClaw (Interview)

SPEAKER_1 (0:00)

What's up, friends?

Gavriel Cohen (0:01)

Welcome back.

Adam Stacoviak (0:01)

This is The Changelog. What if the most important viable thing you own, your crown jewels, was code you just gave away for free the same weekend that you wrote it? Well, this week I'm talking to Gavriel Cohen, the creator of NanoClaw, about exactly that bet. We discussed why restrictive open source licenses are pointless in a world where agents can rewrite any code base in 12 languages overnight. How he sat down with a cloud code he didn't even know OpenClaw existed and built NanoClaw from a blank slate. The moment Carpathi tweeted and shut down a marketing agency doing hundreds of thousands in ARR and Gavriel's vision for a human-centered future where every knowledge worker becomes a manager of hundreds of agents. Heads up, I'm doing a live show with Taylor Otwell at Resend Forward. Check it out at resend.com/forward and I hope to see you there. A massive thank you to our friends and our partners at fly.io. That is the home of changelog.com, your agents in a computer, and that is what they built. Learn more at fly.io.

Okay, let's do this.

Well, friends, this episode is brought to you by our friends at coder.com, secure environments where developers and agents work in parallel. And I'm joined by Nicky Pike, Field CTO for Coder. Nicky, what is a field CTO?

Nicky Pike (1:33)

So I get that question a lot and it's, you know, half the people understand it, half the people don't. So field CTO, I describe it very simply as we're dev rel for the C suite. So we provide a bridge between the customer voice, between the C suite and the managers and the leadership teams of our customers, back into our product. And then we go through and we help enable our teams to have the same message, to make sure that the message is correct and that we're building on something that people actually want, not just something that we think they want.

Adam Stacoviak (2:00)

Okay, so we're taking the laptop away from the developer. Not really though, we're putting them in a cloud development environment, a secure environment where they can work with their agents in parallel, these are blessed environments. What's wrong with the laptop?

Nicky Pike (2:12)

The laptop is the trap here, and not only because the fact that it could be stolen, you could lose it, it breaks, and you're out of work while you're waiting for a new one, but there's also just the consistency that you got there. We all know developers, developers are going to be looking for some of the latest and greatest, and if you're not really controlling how they get out there, that's where you get this, it works on my machine, it doesn't work in production, it doesn't work anywhere else because you don't have that consistency, you don't have that ability to really standardize what that environment looks like. And this is a problem not only for new people coming in, you know, the onboarding statement is, average I think is like four to five weeks for a new employee to really get their local laptop set up and ready to start doing their first time of code. And you know, the time to first commit is a metric that almost everybody knows. And the reason they can't do that is because there's a lot of tribal knowledge out there, they got to go talk to other developers, what are we using, where do we get our dependencies, are we getting them from public, are we getting them from private repositories, but there's also the security and the supply chain aspect of this. When you have local machines out there, look at like the shy hulud, that virus that went out not long ago. This was a compromise of the MPM public repositories. They went and downloaded things, MPM did what it did, next thing you know, you're compromised. But when you use something like what we're doing with cloud development environments, then you can mandate and you can put restrictions on there to say, hey, you can only go get your packages from our private repo. Those packages are expected to have been thoroughly vetted, we know that they're clean, now does this stop everything like shy hulud? No, if that compromised package gets into your private repo, you can still have that, but it really reduces the surface area of the attack and it also reduces the blast area of the compromise should it happen, because if your laptop gets compromised and you have to kill the laptop for whatever reason, that's weeks out of work while you're either fixing that or you're getting a new laptop in. The cloud development environments allows you to kill that, start back up fresh and you're back and running in five minutes. You don't have to wait all that time.