Secure-by-design is a mindset, not a feature

Announcer:
Ready to explore the extraordinary world of tech. Welcome to the XTech podcast where we connect you with the sharpest minds and leading voices in the global tech community. Join us as we cut through the complexity to give you a clear picture of the ideas, innovations, and insight that are shaping our future.

Debbie Forster MBE:
Hello and welcome to XTech Podcast by Fox Agency. I’m your host, Debbie Forster MBE. I’m a tech portfolio consultant and an advocate and campaigner for diversity, inclusion, and innovation in the tech industry.

Today, I’m really delighted to be joined by James Hall. He’s the founder at Parallax. James, welcome to the show.

James Hall:
Thanks so much, Debbie. Thank you for having me.

Debbie Forster MBE:
So, James, I like to start with people as humans, strangely. And one of the ways that we do that and the audience can get to know you is I’m always fascinated to hear how people get into tech. Like me, you sort of wake up one day and think, “Oh goodness, I’m in tech. What happened?” Others born with a laptop in hand. What about you? How did you find yourself here?

James Hall:
Yeah. Well, my dad was a musician, so he always had keyboards and all bits of computers lying around. And we had a family friend gave us an old green screen Apricot computer, and I was absolutely fascinated by it. I mean, one of the issues with it was that the floppy disc drive didn’t work. And so, any software that was going to be put on the computer had to be typed in by hand, basically. So-

Debbie Forster MBE:
And I have to interject at this stage, James, because there’s a real split in the audience now. There’s going to be people of my generation going, “Ah, Apricots and floppy.” And then there’s also people and they’re going to go, “Floppy? Googling what is floppy disc? How does that even work?” So, okay. Now that we’re back in the room, so you were properly doing that from a really young age. How old were you when you were doing that?

James Hall:
About eight years old when I was doing basic programming. But yeah, I was going to the library, there was a lot of children-focused programming books that I’d worked my way through pretty quickly and then I moved on to getting an adult library card, and that was very exciting for me.

Debbie Forster MBE:
You went up to the big leagues. You promoted yourself to the big leagues.

James Hall:
That’s it. Yeah. You have to obviously get your parents to sign it off and, yeah, you get a special card. And then, yeah, I remember just carrying these huge books with me on the bus with my dad or my mum. And yeah, just absolutely fascinated by them.

Debbie Forster MBE:
So, you’re geeky to your DNA roots. Yeah? You’re proper geek. Yeah? Proper geek.

James Hall:
Oh yeah, definitely. Yeah. I think my dad normalised being a geek with being a normal thing because he was always talking to me about stuff that was way above what I could ever understand. And for some reason, I decided that, because my dad was a musician, I decided I’m going to be a musician as well, so I took music tech at college. I think I was about a week in and I thought, this is not a career, is it? This is more of the hobby, I’ve accidentally gone and done the hobby.

So, I dropped out in the second week and just started working a company in York called Bright Five, it was just a few of them, and they were working all sorts of amazing software for, it was called GNER back then, the train company, I think it’s now LNER but-

Debbie Forster MBE:
Oh, yeah, yeah.

James Hall:
They were building software to help train their staff, and I was just helping out and learning the ropes. And very quickly, my boss just kept ramping up the amount of difficult stuff that he was giving me to the point where I started running larger projects. And they gave me part of the company, which was really cool when I was approaching 20. And then, I set up my own thing.

Debbie Forster MBE:
Not too shabby.

James Hall:
Yeah, not too shabby.

Debbie Forster MBE:
And I think this is what’s so important when people are looking to hire people. It’s such a shame when people are falling into that old, “Well, did you do your master’s in computer science? Did you do your things,” instead of looking at the human in front of you and what you did because your alternative route actually fast-tracked you to where you are.

James Hall:
Yeah.

Debbie Forster MBE:
It didn’t slow you down.

James Hall:
I think so. I think so. Because computer science to me, when I was looking at it, obviously looking further ahead at uni courses, all the topics didn’t really interest me because it was like old hat. It was a lot of Java rules-

Debbie Forster MBE:
You did that with your library card back when you were eight. What would you-

James Hall:
Exactly. Yeah, yeah. I was more interested in writing Windows desktop apps and GUIs and, yeah, all sorts of weird and wonderful things when I was younger. And I think all that experience just, yeah, it layers on, doesn’t it? Because when I started working at Bright Five, they would say yes to everything. So, people would come up and were like, “We want to write this HR platform,” or, “We want to do this.” And I just thought it was fascinating how they would just go, “Yup,” even though we didn’t really know how we were going to do it.

Debbie Forster MBE:
Yeah. But you were the dream because you are the drive-up window. I’d like an order of HR platform with a side of some stats to come out. But that’s the perfect relationship to try and do where you can make and build in that way.

I was fascinated to learn when I was cyberstalking you online that you were so big in the JavaScript space, you’re an AWS Hero. So, you were actually, again, some of the people on the show will remember, you were the one behind the jsPDF library. How did that happen?

James Hall:
Yeah. So, that’s a funny story, really. So, I was browsing Stack Overflow which is popular programming website, and I had spent a bit of time on there trying to earn points, answering lots of questions, just sort of learning my skills around programming. And someone asked a question around, “Can you generate a PDF using just JavaScript alone?” And all the responses were like, “No, don’t be ridiculous. That’s not possible.” But I started thinking maybe it is possible, because this is back in IE6 sort of days and generating binary files to JavaScript – it was pretty curve ball sort of batshit idea.

So, yeah, I just gave it a go. And my first response to the question was just a link to Google Code with the solution. And it just took off from there. But it still gets about 4, 5 million downloads a month.

Debbie Forster MBE:
Yeah. And it’s still going strong. How do you balance? Does anyone ever question how you are balancing that sharing the knowledge publicly with competitive advantage and IP, that sense of open-source and where does it fit in today’s tech world?

James Hall:
Yeah. I think open-source building blocks are the foundation of modern software. And I think a lot of code we write isn’t the competitive edge. Nobody was going to have a competitive edge because they’ve generated a PDF invoice. It’s all the other stuff around it.

Debbie Forster MBE:
There goes my exit strategy, really. Okay.

James Hall:
Yeah. This is why I could never monetize jsPDF. But no, I think balancing open-source work with commercial work makes total sense. And often, I find that we do it when we’ve built something quite substantial on top of a bunch of open-source stuff and some of the libraries start to creak and need a bit of love and attention in certain areas, that’s when we tend to use our working day to patch these things up and sort of improve those building blocks.

So, I mean, even on commercial open-source projects that recently, we’ve been doing lots of AI. So, one of the building blocks we use is Inngest and they have an open-source library. But there’s just some stuff that doesn’t work as well as it should, and we actually go in and just fix it for them because it’s actually quicker and better for us to do that because then, they look after our fix forever and we don’t have to maintain those patches. So, yeah, it swings and roundabouts.

Debbie Forster MBE:
And I think that’s important. In the big land grab that’s coming up through AI and everything, I think there is this source for people who are in the know, for the dev community, that open-source approach is staying at university. That’s the ongoing learning, isn’t it? That’s how we keep raising the floor, raising the foundation that people can build off, and I think we neglect that at our peril.

James Hall:
Yeah. I think more than ever, constant learning is extremely important in your careers. And yeah, open source is just a little part of that, isn’t it?

Debbie Forster MBE:
Yeah. Okay. So, when I was looking also, I noticed that you had pioneered some serverless technology on a project that’s quite cool. Again, to anyone that’s thinking, “Okay, serverless technology,” but it was actually quite a cool project with David Guetta and UEFA. So, tell me about that.

James Hall:
Yeah. So, it was the EUROs and a company had come to us because they’ve got the contract with UEFA. Yeah. They basically wanted to have a million people sing along to David Guetta’s new track. So, they were like, “Can you-

Debbie Forster MBE:
As you do.

James Hall:
Yeah, as you do. Yeah, standard brief. Can we get this online recording studio spun up? Can we have some videos of David Guetta? Little examples of him singing, record button, can we make some album artwork? I’m thinking, “Yeah, all this is great.” But the spanner in the works was David Guetta was going to read this URL out on TV, which adds a whole new scaling damage into the whole project.

So, we did some projections. We were looking at just spin up as many EC2 nodes as possible. And this was like in 2014, so the Lambda and API gateway were extremely new. We’d got early access to some of that tech through AWS. And yeah, we basically just picked up this kind of a immature open-source framework called JAWS, which we’ve been chatting to people about, and really just tried to build this recording studio on top of it.

And obviously, that comes with some challenges because the tech wasn’t quite there. And so, we had to talk with AWS, take some of the limits of concurrent Lambda execution. We had to figure out a bunch of stuff with fonts and Japanese characters and, yeah, all sorts of stuff we needed to patch in JAWS itself. But after we launched that, it became a major case study for this is how you can make almost infinitely scalable apps on AWS. And then, I think the serverless term came after that.

Debbie Forster MBE:
Yeah, build it then name it, right? Just get the thing up and running, then we’ll come up with a name. So, 11 years on, how do you see serverless evolving, particularly with the rise of the workloads from AI, from machine learning, and is the tooling landscape where it needs to be?

James Hall:
I don’t think it’s quite there yet. I think application performance monitoring tools, back in the day, you’d have this sort of the gold stars like New Relic and people like that who were really doing it well. I think what we’re going to see now is companies trying to create that in an open-source environment. So Open Telemetry, that kind of tooling has got a little way to go, I think. It is improving, but I think that’s the area that we need most of the help, especially since say an AI application. So, we take a bunch of data and a user’s asking a question about something, and that LLM process can take quite a long time. So, instead of really quick unit tests that we used to have when we were building database-driven applications, now we’ve got these long-running LLM processes spinning off MLs to … So, I think for developers, it’s really good for them to see it in visual form, in a chart so they can spend 20 seconds executing this and then it does that. And then you can really sort of dive in and debug it. I think that’s where it needs to go.

Debbie Forster MBE:
Okay. All right. Well, let me take us a slightly different direction. Geopolitically, things keep moving ahead and we really need to start thinking more and more as DevSecOps shifting left on security. And that’s a real shift in thinking for some. How are you helping clients understand and do and build secure-by-design applications? What’s the trick there?

James Hall:
Yeah, I think there’s a bunch of tricks you can do. There’s no one single thing that works perfectly. I’m a big fan of a risk register, so let’s get all the … Yeah, let’s get all the-

Debbie Forster MBE:
That’s very rock and roll.

James Hall:
… potential risks out there.

Debbie Forster MBE:
Yeah, give me a good risk register.

James Hall:
Yeah, 100%. I mean, yeah, just imagine the worst thing that could possibly happen and write it down because that is actually a really good starting point for figuring out where your security issues link may be. It could be denial of service or someone actually hack into it. But when we were working on the Streetlighting project, the big fear headline was Aberdeen plunges into darkness. That would be the worst headline you could ever imagine. So then, you work back from that. How do you prevent that? What checks and balances do you put in place?

Debbie Forster MBE:
And that is a framing device is really good because if you’re not technical, thinking about security, being hacked, etc., is a kind of yeah, yeah, yeah. Turning it into what’s the headline in the Daily Mail suddenly brings it sharply into focus and gets businessowners and account holders really focused on what’s going wrong.

James Hall:
Yeah. Well, business leaders are always thinking, “So, what?” Well, everyone is aren’t they, they’re listening to this podcast and they’re thinking, “Why am I listening to this? What I’m going to get out of it?” So, if you can always answer, “So what,” then you’re halfway there, aren’t you?

Debbie Forster MBE:
Okay. Well, that makes sense on how you get your clients thinking in that way. But we’ve got to get our devs, we’ve got to get our engineers thinking in that way. And that’s not always their first love. How do I make sure they are more instinctively thinking secure by design?

James Hall:
I think to start with a good checklist, and I think even making a simple checklist can prevent most problems. You see it in aviation. You see it in healthcare. These are sectors that have very high-safety levels and they get there just through simple checklists. Because humans are human, they can very easily forget things, they’re not very good at paying attention, they’re not very good at looking for things that could go wrong sometimes.

Attention drifts. This is why self-driving cars quite tricky because the idea originally was the car drives 98% of the time and the human’s expected to jump in when it’s going wrong, which is the worst way around. Their attention’s elsewhere. So now, they’re sort of reframing that, aren’t they, as you are always there and then the AI jumps in when something’s wrong.

Debbie Forster MBE:
And that’s a great way of changing, isn’t it, for you? Because you’re very experienced pilot is still going to go through their checklist because that’s just been ingrained in them from the start. And we can do that with our engineers.

James Hall:
Yeah. It gets embedded into the culture that anybody, regardless of seniority, can call someone out for not following the checklist. So, you could be the most junior person in the room and say, “Hang on, why haven’t we checked this off?” And that’s as true as in aviation as it should be in software engineering because everyone should agree ahead of time these are the base-level things that we’re going to agree to do. And if you disagree with doing them, you should do that at the start. Otherwise, it’s in the checklist, it gets done.

Debbie Forster MBE:
It’s our DNA. That’s what we do. That’s how we roll. Good. Okay. So, super checklists and it’s our DNA, like the pilot checkoff and reframing headlines, scary headlines for our clients. Wonderful way of doing that.

But we don’t want to just scare our clients. I’m aware of looking at Parallax’s success, discovery workshops are a really powerful part of what you do. Can you walk us through that and what’s the secret, I think, most particularly in getting the most out of them for yourself, for your company and for the client?

James Hall:
Yeah. I think we build software for clients, so there’s an infinite number of possibilities of things that we could do. But you really want to frame it around what is the, turning it on its head from the worst headline, what is the best headline? What’s the PR story? What’s the press release? If you change the world, what would that look like? And that can be a really good framing. Because a lot of companies have quite shallow business values, they’ve just plucked some words out of the air and gone, “We want integrity,” and all this kind of stuff.

But actually, diving a little bit further into it – so, my friend Josh is the CTO of an education company, they want to revolutionise how people learn and the headline is always around people with learning disabilities or lifting people up. So, a simple sentence like that not only helps with hiring and getting people on site, but it also helps define the products that you want to build. And it’s good framing for knowing what to avoid as well like, “Oh, we were in this camp. We’re going to do this good thing, which means we should avoid doing that thing.”

Debbie Forster MBE:
And it also helps companies avoid that old, “I read something about agentic AI, build me some agentic AI,” or, “Build me a gen AI,” or, “Build me a bot that does…” It drives back to those headlines, the why to what’s the business game.

James Hall:
Absolutely. Because a lot of people at the moment are saying, “I feel like I’m missing out on AI. Let’s build some AI thing.” And I’m excited by AI. I agree, it’s exciting, but it’s not starting with the problem first.

And there might be some AI involved in it or there might not, but you shouldn’t try and shoehorn it into a project.

Debbie Forster MBE:
Okay. So now, I know you are a big fan of side projects, and there was a time when tech very much embraced that, that side projects were a smart, savvy business way of doing things. As times get hard and side projects, people talk about, “I don’t have a site of desk. My desk is smaller and smaller.” Why do you think it’s still vital in tech to have these side projects and how do you build that in Parallax?

James Hall:
Yeah. So, we do hack days. So, we get everybody in a room, put some food on, and we get people to group off and they decide what kind of work they’re going to do that day. So, someone made an AI cat flap, so it decides if they’re bringing anything in from outside. And someone’s been working on a cocktail-making machine that uses robotics. Although they’re all silly daft ideas, the journey that you go on to create them, is really important. So, you all are going to do this seemingly silly thing, but you’re going to learn so much along the way. And because you can fail in a safe way, it’s not like you’re on a client project or you’re doing something with supersensitive data or something like that. You can actually just try these techniques out and then you can bring that back with you.

Debbie Forster MBE:
And do you have some side projects you can think of that have really made a difference for you as a developer in your own right?

James Hall:
I think for me, it’s getting away from a computer that is sort of my side project. So, it’s like I’m a huge fan of cooking, so it gets me away from the screen. It’s something I can focus on. But yeah, this idea of mise en place, so everything being in its place, everything being prepared.

And me and my friend did pop-up restaurants, so we would be very much using the same sort of planning and techniques that we would in software engineering, like the checklists and sketching things out and all that kind of good stuff. Everything sort of cross-pollinates, doesn’t it? What makes a good dish, it’s also what makes a good project. You need to look visually good. It needs you to need to communicate what it is.

There’s all this sort of crossover and I think just taking yourself out of your comfort zone in a completely different area is going to just improve you as a person hopefully.

Debbie Forster MBE:
And I know because we’ve chatted about, part of mise en place is your station is tidy, everything is planned out in those sorts of things. And so, my takeaway from the call is my other half is in tech, loves cooking. He does a very, very clean engineering environment, not so much in the kitchen. So, I’m going to flip the side project on that, James, and I’m going to sit him down and talk about how can we take our software principles and apply them to what you’re doing to the kitchen and how we do this and shape up the … I’ll come back to you on whether that actually helps me. So, I think pollination on side projects can work both directions in that sense. So, my poor partner, I’ll let you know if that makes any progress.

James Hall:
Yeah, fingers crossed.

Debbie Forster MBE:
Yeah. And I noticed, I saw something on LinkedIn, you were talking about you’ve been running a side project that was blending XGBoost, DRF, GBM with Claude. And what was interesting taking the strengths of each and having an explainable breakdown. Can you talk me through the project and what did you learn? Because I find it fascinating what you were working on there.

James Hall:
Yeah, absolutely. So, this is actually a client project.

Debbie Forster MBE:
Oh, right. Okay.

James Hall:
We were looking at horse racing odds prediction. So, the first project is trying to figure out how well horses going to do based on their past performance. So, we were training specific ML models around that. But getting Claude to explain its thinking in readjusting some of those odds because each horse race is almost completely different in terms of depending on the field size, depending on lots of different factors. So, you need to reweight all the odds. So, we’re taking the best of each.

But having that provable explainable breakdown of why it comes to that decision is really useful. And then, yeah, we’ve gone on to add other features to that project, but it’s, yeah, blending all those things together has been really interesting for us.

Debbie Forster MBE:
And it’s interesting that you’re using Claude in that. And that’s because Claude has some strengths in that respect, not just on the large language models but on something else?

James Hall:
Yeah. It’s a really good linear and nonlinear regressive as well, secretly. There’s a paper on this and-

Debbie Forster MBE:
Really? Interesting. So, there’s a secret superpower not all of us know. So, that’s an interesting learning for me.

James Hall:
Yeah. LLMs are good at numbers too, but you just have to talk to them in the right way and have the right evaluation framework around it to make sure it’s doing the right thing. But yeah, it’s seriously impressive with the little training as well.

Debbie Forster MBE:
Okay. All right. We’ll keep in eye. And for the horse racing, I hope that I’ll somehow benefit from that and you’ll let me know where I need to place my bets.

James Hall:
I’ll give you a few tips. Yeah, don’t worry.

Debbie Forster MBE:
Excellent. Good, good. Okay. Look, we’ve covered all around what’s very much the day job for you. I like to hear from guests what’s happening, where are you looking on the horizon that is either capturing your interest in a good way or worrying you? What’s going on for you?

James Hall:
I think agentic coding is very much at the forefront of where people are looking at the moment. I think it is really interesting for us, especially around prototyping UI, especially for getting ideas out. I think there are some blind spots in there, especially around security and, yeah, integrating more complex things together. There could be a lot of issues, especially if agents have access to private data and things like that.

I think one of the blind spots we’ve got is it’s maybe preventing companies from hiring juniors which I think is an error. Because, yeah, no company really likes to think more than a couple of years ahead and they’re just in this sort of economic climate, they’re always thinking about the next month, the next quarter, the next half year. But if they actually extrapolate what they’re doing out over the years, you’ll see that we’re probably forgetting about generation of coders. So, that’s just going to come bite us, I think.

We have just hired an amazing apprenticeship student who he just soaks everything up like a sponge. He’s super eloquent, and he just needs that environment where he can learn and try things and fail and learn from others. And I think if we go down the road of not doing that, I think we’ll look around in two years and there’ll be a bunch of seniors using agentic tools and getting stuck or frustrated because they can’t scale. Or maybe there’s a new tool out, that means we need those juniors’ workforce back again and suddenly, we’re stuck, aren’t we?

Debbie Forster MBE:
James, you’re really talking about a bugbear for me. And I really see that as we’re watching the drops in hiring for junior devs. To my mind, the way I’m starting to describe it is we’re cannibalising our talent pipeline. And I think it is, it’s economy-driven, it’s trying to look at … And it is a very easy formula to look at. One mid or senior dev can do the work of five juniors, et cetera, et cetera. But like you say, what are we losing in that early career that we’re suddenly going to need? And then there’ll be the next big talent shortage, et cetera. And I think companies like you who have been building that pipeline, a loyal pipeline, and you’re known for that because otherwise, we’re going to have those pinch points again.

And interesting you say two years because I was originally saying three to five is when we feel the pain. Someone was saying to me 10 the other day. But you’re probably right, in two years because skills aren’t static and we don’t know what is around the corner with this. And so, I think in the same way that I’m forever trying to talk to companies about, it’s not a cost training, it’s an investment. I think there’s the same thing on your junior pipeline. This is not a cost, this is an investment that you’re going to reap. Because I think we’d also say, wouldn’t, we that senior devs benefit from working and nurturing junior devs as well?

James Hall:
Absolutely. It’s like a muscle that you need to exercise is teaching other people. And if you’re not nurturing and teaching others, you can become a bit lazy and you’re thinking in some respects because you think, “Oh yeah, I can do that. I know that back of my hand, easy.”

And you’re probably not exploring all the potential opportunities there. Whereas if you actually sit down with someone and try and show them your thinking, show them how you do something, talk them through it, you can then see the gaps in your own thinking. And people are very good at thinking they know something, but then when it actually comes down to it, you can’t self-evaluate. Unless somebody tells you, you don’t know what you’re not good at.

Debbie Forster MBE:
The benefit of the junior questions, why do we, why don’t we, can really throw open some powerful doors when we’re thinking about these sorts of things.

James Hall:
Yeah, exactly. Because sometimes I ask the dumb question, but actually it’s not a dumb question and you think, “Oh my god, maybe we’re thinking about in the wrong way.”

Debbie Forster MBE:
Exactly. It breaks through that group think. And that group think that quite often AI will just then replicate, this is going to carry on doing what it’s been instructed, the structures it’s been given. And so, that genuinely out there thinking question, we’re probably missing some opportunities there. All right. Well, I’m in violent agreement with you on that one.

So, last but not least, returning to you as a human again, what are you reading or watching or listening to that is valuable?

James Hall:
I really enjoy listening to Lunchbox Envy, and it’s the QI researchers and they’ve gone off and done a podcast all about food. So, they’ll pick a potato or eggs, and they’ll just go really deep down into minute detail, like silly stupid facts. And it’s just really easy listening for me. It’s like if you miss one fact about potato, you’re not going to have to rewind it and listen to the whole thing again. But it’s just nice, interesting sort of stuff to have on in the background.

But I think listening to podcasts for me is really important for learning, but you can also get a lot of depth from just a couple of things that people say as well, like a lot of tech podcasts. But yeah, things like, I don’t know, do you use Blinkist or anything like that? Have you seen that?

Debbie Forster MBE:
I have just started. Do you want to talk to the audience about that?

James Hall:
Yeah. So, I find a lot of business books and tech books specifically that may be like five good points and then enough waffle to pad out, so it’s the length of a book.

Debbie Forster MBE:
To make the publisher happy, right? To just … Yeah, yeah.

James Hall:
The publisher’s happy now. Yeah, yeah. And some people like that sort of repetition and it makes it go in better. But I think Blinkist, if you can just listen to the summary from there, you can get 70% of what the gist of the book is and all the nice cool little gems and quotes and things. And yeah-

Debbie Forster MBE:
And very consumable because it is that thing you can do where you’re running, driving, something else as well. It’s a great way of flipping the way of taking information.

James Hall:
Absolutely. And because there is so much stuff to learn around AI and ethics and all this kind of stuff that is new to a lot of people, you’re not going to get through all those books any other way. So, yeah, I would recommend Blinkist as well.

Debbie Forster MBE:
Listen, thank you so much, James, for joining me on the episode of XTech. I really enjoyed talking to you, and I will work on my partner on his mise en place in the kitchen. I appreciate that.

James Hall:
Awesome. Yeah, I’ve been really lovely to chat to you and, yeah, good luck. I still use way too many pots and pans, so maybe I’ve still got some work to do.

Debbie Forster MBE:
Don’t ruin it for me, James. That’s not what I’m going to tell him. And I’ll make sure he doesn’t hear that.

Thank you for listening. If you’re a tech innovator and would like to appear as a guest on the show, email us now at XTech at Fox Agency.

And finally, thank you to the team of experts at Fox Agency who make this podcast happen. I’m Debbie Forster and you’ve been listening to the XTech podcast.

Announcer:
Keep exploring the world of tech. Subscribe to our podcast and never miss an episode. To discover more opportunities for global B2B tech brands, visit fox.agency today.