PRODUCTHEAD is a regular newsletter of product management goodness,
curated by Jock Busuttil.
product (mistreated) #
every PRODUCTHEAD edition is online for you to refer back to
tl;dr
The ethics of AI products must be considered alongside their desirability
Software builders are defending their identity by becoming software factory builders
Positive friction in the product process acted as a quality filter
hello
The last couple of weeks have certainly had their moments. The internet collectively soiled its pants about the PHP2Shell vulnerabilities; there was added drama when at least one organisation broke the embargo early giving would-be attackers a head start (the published code fixes highlighted where the vulnerabilities lay).
Beneath the breathless reporting in the mainstream media of the number of websites worldwide being pulled offline to allow time for patching, there was a more pertinent lesson. The PHP vulnerabilities in question were discovered in 2024 but were considered too difficult for bad actors to exploit. There are plenty more of these in all manner of software underpinning the systems and services we use daily. AI-assisted vulnerability discovery increases the number of potential vectors for attack, and AI exploit development has shortened the time it takes to craft a working exploit for them.
The lesson we should take away from PHP2Shell is that there will be many more incidents like this in the future, and the grace period between disclosure and working exploit is now hours – if even that – rather than weeks, months or years. Service providers will need to restructure themselves to be able to respond far more rapidly than perhaps they’ve been accustomed to in the past. And we, as consumers of their services, need to consider how much of our day-to-day activities rely on the assumption that these services remain available. It’s no longer a case of thinking about ‘what if …?’, but planning for ‘what happens when …?’
To end on a more positive note, it was a pleasant surprise to see the BBC call out Ondřej Surý’s unseen contribution to resolving the worldwide ‘PHPocalypse’. For over 20 years, he has voluntarily worked to package up and release the latest software patches to PHP, making it significantly easier for system administrators to apply them in timely fashion. There is a strong argument that the PHP Foundation should have shouldered this responsibility a long time ago, and yet Ondřej has continued to plug away in the background. He is another perfect example of the individual whose (largely unpaid) work keeps the modern internet from collapsing:
For you this week #
Roman Pichler reminds us to consider the ethics of the products we create and ship, particular when AI is involved. There is more to be done than simply having robust evals. He suggests assessing the ethics of the product immediately after its desirability as a key success factor.
An earlier edition of PRODUCTHEAD also covered ethical product management from the perspectives of several writers, while techniques such as consequence scanning and red teaming exist to uncover potential harms caused by the use and misuse of our products. As I wrote back in 2018:
“The AI will only be as good as the task we set it, and it’s our responsibility to consider the implications of the AI fulfilling that task.”
Hopefully now fully recovered from COVID, John Cutler compares the industrialisation of software development to the industrial revolution and explores how it affects our sense of identity and agency at work.
Jeff Gothelf looks at the implications of working in a large company when everyone is suddenly a product builder, and offers suggestions for ordering the chaos. Although he doesn’t use the term, the friction there used to be pre-AI to create and ship products also acted as a quality filter. John Cutler also wrote about this idea of ‘positive friction’ recently.
To wrap up this week’s edition, Elinor Lange challenges the traditional PMO (project management office) approach to staffing ongoing work. She makes the point that specific skills and experience are not evenly distributed across organisations, but are instead embodied in individuals who need to be available at the time you need their skill. And the more frequently a particular skill is needed, the harder it is to predict when it will be needed. (h/t to Emily Webber)
Speak to you soon,
Jock
what to think about this week
Product Ethics in the Age of AI
AI is changing not only what product teams can build, but also what they need to take responsibility for. As digital products increasingly affect privacy, safety, fairness, human agency, and the environment, product ethics can no longer be an afterthought, a checklist exercise carried out just before the product is shipped. Instead, ethicality should be a core product success factor that is as important as desirability, feasibility, and viability.
Make ethicality part of your innovation process
[Roman Pichler / Pichler Consulting]
TBM 448: The Software Factory as Identity Defense (and Reinvention)
We’re reimagining the future of work one professional silo at a time.
All the original builders are now building factories
[John Cutler / The Beautiful Mess]
How to manage the inevitable mess of running a company where everyone is a builder
I was at a family event recently and ran into two cousins. Both work in tech. One is a designer, one is a group product manager. The designer works at a company of about 100 people. The GPM works at a larger company of about 4000 people. Family gatherings can serve multiple functions including, in this case, a little customer discovery work on my part. I chatted with both of them about how AI is changing the work they’re doing along with how their companies are handling this new tech. Their responses were eerily similar.
The build and deployment process was never just about bureaucracy
[Jeff Gothelf]
The Availability Trap
When the expertise is part of the team but isn’t available when needed.
Decisions without having to schedule every specialist contribution in advance
[Elinor Lange / Dandy People]
recent posts
Chess is easier when you can see the board
A Wardley Map is to corporate strategy what a chessboard is to players: you can absolutely play the game in your head without seeing the board, but if you can it’s a lot easier to play, and you have a massive advantage over the people who can’t.
Know what moves you can make, and why to choose this move now
[I Manage Products]
How to form a go-to-market strategy
A go-to-market strategy isn’t something you tack on as an afterthought to an upcoming product launch. Instead it’s about understanding where value exchanges occur, and figuring out how to make them more frequent, consistent and predictable.
Go-to-market emerges from your discovery
[I Manage Products]
We’re all addicted to AI, but it’s going to be okay
We seem to stuck in a contradiction in which we worry about AI’s effect on our critical thinking, while finding it equally hard to resist using. Why is that?
[I Manage Products]
can we help you?
Product People is a product management services company. We can help you through consultancy, training and coaching. Just contact us if you need our help!
Helping people build better products, more successfully, since 2012.
PRODUCTHEAD is a newsletter for product people of all varieties, and is lovingly crafted from a a tidy brush plate.