Services
Activity
2K followers
-
Matt Muschol posted thisHow do you know that your AI-generated code is not violating intellectual property rights? Well, the answer is simple: you don’t, unless you scan for it. AI models are trained on vast amounts of publicly available code, including a lot of Open Source code and some proprietary code. It is therefore possible for a model to produce a code section or maybe even a whole file that is a perfect match for a piece of code in an Open Source project. Now, that’s fine, right? It’s open source, so we don’t have to worry about that, right? No, that assumption, I’m afraid, is wrong. What if the code matches a section of code from an open-source project released under a restrictive licence? The licence conditions could in theory mean that you would have to release your own commercial product as open source (or change all the offending code immediately). Since no-one has access to your proprietary code base, you may not find out about this until you come to sell the business or the rights to one of your commercial products. Even before the AI era, I saw this type of issue become a major challenge for acquisitions. We used to be a Black Duck partner and we were involved in intellectual-property and licence scanning of software products during the due diligence process for acquisitions. Some acquisitions never went through, and others resulted in a lengthy process to fix the product before the acquisition could go through (and whilst I wasn’t privy to that information, I wouldn't be surprised if it had an impact on the purchase price). It’s important to note that most AI vendors do NOT guarantee that the code they generate is free from intellectual property rights. This post is mostly about open-source but vendors don’t even guarantee that it is free from proprietary copyright violations. It is your problem, and you have to solve it yourself.
-
Matt Muschol posted this“We do not ship code we don’t understand.” This has been a rule I have consistently applied with all of my development teams for many, many years. And the rule is even more important now than it has ever been. A few years ago, the rule was primarily triggered by code found on Stack Overflow. During a code review, if the answer to “hm, how does this work?” was “I found it on Stack Overflow”, then the review was rejected. I was often challenged on that by team members, and the answer was simple: the problem is not that they found inspiration on Stack Overflow. The problem is that they don’t understand why it solves their problem. That means that they don’t understand under what conditions it will break. Fast-forwarding to the AI era, the human-in-the-loop principle is massively important. If you don’t review AI-generated code, then that introduces security risks, can lead to customer-facing bugs, it can lead to an every-increasing (in size) codebase, and most crucially new types of excuses like “oh, Claude did that, not me”. I’m sorry, but that answer is not good enough. If you can’t vouch for the code, don’t ship it.
-
Matt Muschol shared thisThe power of AI: the latest trend appears to be to overcomplicate your ticket-management processes and then use AI agents to automate it. I'm sorry but what's the point? Whatever happened to the KISS principle? Anything you build has a Total Cost of Ownership. You will have staff busy wondering why certain tickets were moved through certain statuses, trying to understand why some tickets get stuck in places. Do you actually need those 32 statuses in your Jira workflow? When we raise the level of abstraction, we mustn't forget how important it is to keep things simple. The things you build today, just because you can, will be the things that will come back to haunt you in the future.
-
Matt Muschol shared thisIs there a right way to roll out AI? I'm not sure about that. What I do strongly believe is that there's a wrong way. If you just blindly automate everything that can be automated, then you will make some bad decisions that may end up costing you more than it saves. Don't do it just because it can be done. Don't do it just because it is saving you time, effort, resources today. Make sure it will benefit you in the long run. My prime example: AI in customer support. I have recently raised support requests with two different vendors. One had a good and helpful implementation and the other one got it very wrong, as far as I'm concerned. Interestingly, they probably have a similar rate of "self-service", i.e. both solutions will reduce the number of requests that need to be dealt with by a human support agent. However, one works, and my prediction is that the other one will lose them customers. The trouble is that new customer acquisition is a lot more expensive than serving your current customers well (and hence retaining them), so the savings of today will cost you dearly in the future. So what works from a customer's perspective is a support system that starts giving you helpful and specific suggestions as you fill out your support request. I'm an Atlassian expert, and I have to admit that a number of Atlassian support tickets I started to raise ended up being solved by the AI-driven suggestions I received whilst raising the request, and I never actually hit the Submit button. My problem was solved. However, when it doesn't solve the problem, you just carry on, construct a well-structured support request that explains the problem in detail, with steps to reproduce, screenshots etc. The quality of the initial response from the human support agent is high because you had the opportunity to explain the problem well. What doesn't work is putting an AI agent in the way, preventing your customers from raising support requests without going through the agent. I've recently raised a request with an Atlassian Marketplace partner this way, and the support ticket the agent raised for me completely missed the point, completely misunderstood my problem. The agent never gave me a chance to review what it was creating or confirm that it had captured my problem. The result: it took me longer to raise the request and at the same time the initial response from the human support agent was of no value to me whatsoever. So thinking long term is really important here. And if it's customer facing, make sure it benefits the customer. My next example is Software Engineering, but I'll save that for another day...
-
Matt Muschol shared thisQuip (by Salesforce) is going end-of-life, and the countdown has started. This is where Quip Integration for Confluence can help. If you are already using Confluence, then with Quip Integration you can import Quip documents and turn them into Confluence pages, including images and other attachments. You can do this document-by-document yourself with the app (available on the Atlassian Marketplace for both Data Center and Cloud). Alternatively, if you would like any advice on a mass-migration of data, then please comment below or ping me a message and we can help you move over.
-
Matt Muschol posted thisBeware of shadow AI through tools that you allow your users to have on their laptops just because you've always done that. My favourite example: Adobe Acrobat Reader. A lot of IT organisations deliver this as the default tool to open PDF documents. Users then think they are using a tool installed locally to read a file stored locally, and when you hit the "Summarize" button, your confidential document gets sent up to a cloud-based service that IT may not have done any security due-diligence assessments on.
-
Matt Muschol posted thisSome features should be on-demand only. For example, I have turned off Smart Compose in Gmail and it feels like a weight has been lifted. I don't like how it's constantly interfering with my writing process. When a tool underlines parts of what I'm writing as I'm composing an email, it feels like the tool says "you are not good enough, let me fix it". It's almost like an anxiety-inducing bully constantly watching over me, nagging me, criticising me. It also takes my focus away from what I am writing when it suddenly underlines something in a previous paragraph ("ooh, wait, what's wrong with that?"). Suddenly, my concentration is broken, focus diverted. First of all, give me a chance to read through my email first. And secondly, no, I don't like many of your suggestions and I don't want to sound like everyone else. I'm actually quite happy with how I word things.
-
Matt Muschol shared thisAI and vibe coding: if you don't understand how the AI-built solution works, then please don't put it into production use without getting advice. I know that a lot of people out there feel empowered by the AI tools that allow them to build solutions that they couldn't dream of building before. But here's a cautionary tale of a product that I came across last week. The customer asked me to review what the AI had built before putting it into production. Alarm bells started ringing before I even looked at the code when they explained to me how they had built it. In a nutshell, the system supported multiple users in segregated sessions at the front-end but used a single session (a personal API token) for some of its back-end services. Basically, given the right conditions, it was sharing pretty sensitive information between users. I advised the customer how to recreate the condition, and hey presto, user A got user B's information out of the system. So before you put such a solution into production, speak to an expert or a friend or a colleague. Speak to someone who knows what they are talking about. Ideally, have it reviewed professionally.
-
Matt Muschol posted thisA lot of good people got caught up in the recent Atlassian lay-offs. Not only developers but also marketing, project management etc. I've never worked for Atlassian directly, but having worked in the Atlassian Ecosystem for 17 years, I do know the calibre of people they employ. There's talent there just waiting to be bagged for your organisations. It's worth specifically looking for those ex-Atlassian's who are "open to work" right now. Just saying.
Matt Muschol commented on a post
3d
Been there, done that, never got the t-shirt (no budget left) 😀
Matt Muschol replied to a comment
1w
Love that phrase. Concise yet clear.
Matt Muschol replied to a comment
1w
Thanks for that, it's such a good way of thinking about it. If you are just knocking something up quickly, then running AI tools on auto-accept may work. However, as you say, that won't work as a long-term strategy.
-
Matt Muschol liked thisMatt Muschol liked thisOnly a couple of weeks away, and so looking forward to: * California sunshine * Pool parties (especially our Eficode/Oboard one) * Announcements and other news * and of course seeing you all there Come by and say hello on stand 314, the bright yellow one, you can't miss it.
-
Matt Muschol reacted on thisMatt Muschol reacted on thisIt's absolutely funny how everyone is posting about life hacks on how to talk to AI, when we all know AI is basically a toddler who will listen to you explain what they should do, nod smilingly and then proceed burning down the house
-
Matt Muschol liked thisMatt Muschol liked thisMost Google Ads accounts don’t fail dramatically, they bleed out quietly. From a growth perspective, that’s far more dangerous. Budgets get approved. Campaigns go live. Spend increases. On paper, everything looks active. But under the surface, a different story is unfolding. Clicks with no intent. Traffic with no direction. Spend with no outcome. At that point, it’s not really marketing, it’s just very expensive guesswork. Here’s where the leaks usually hide: 🕳️ The wrong clicks If your search terms aren’t tightly controlled, you end up paying for curiosity instead of intent. People browsing, comparing, or looking for cheap when you’re positioned as premium. 🧭 The wrong destination An ad makes a promise. If the page doesn’t deliver on that exact promise, the journey breaks instantly. That drop-off? You paid for it. 📊 The wrong visibility Spend is easy to track. Outcomes are not. If you can’t connect cost to qualified pipeline or revenue, optimisation becomes opinion-led instead of data-led. The shift is simple, but most teams miss it: Stop asking “How much are we spending?” Start asking “Where are we wasting budget?” Because growth in paid media rarely comes from spending more… It comes from spending sharper. Plug the leaks, reallocate with intent, and turn paid search from a cost centre into a growth driver.
-
Matt Muschol liked thisMatt Muschol liked thisWe have three rules every developer using AI should know. Right now, engineering teams are in a grey zone: people started using AI tools before any rules were made. We are no different. We wrote our policy retroactively, like around 10 people from different teams writing down what they'd learned from actual use. The result is 27 pages, but these three lines are gold: 1/ If you wouldn't email it to an unknown vendor, don't paste it into an AI tool. People have a decent instinct about what they'd send to a stranger. That instinct breaks down when the interface feels like a chat window. Client code, credentials, production logs, internal architecture – none of it belongs in a prompt. 2/ If you can't explain the code, don't commit it. The commit is yours regardless of who (or what) wrote it. AI output requires the same understanding you'd apply to code from a junior developer. If you can't explain the change and its blast radius, you haven't reviewed it. 3/ If licensing or compliance is unclear, stop and ask Legal or Security. New tools must be routed through security, legal, and procurement before use and any time developers have doubts, they should escalate it to the security department.
Experience & Education
-
Swiftix Software
View Matt’s full experience
See their title, tenure and more.
or
Recommendations received
2 people have recommended Matt
Join now to viewExplore more posts
Explore collaborative articles
We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.
Explore More