LATEST / 2026
28 AUG · DUFFY INTRODUCES NEO SECURITY RESEARCH PREVIEW ↗

People / The toolmakers Seattle, Washington

Joe Duffy and the trouble with making things simple

He helped open .NET to the world, then left Microsoft to make cloud infrastructure programmable. At Pulumi, Joe Duffy keeps returning to a stubborn question: why should powerful computers require such painful tools?

Advertisement

Joe Duffy once helped build an operating system with experimental keywords so awkward that his colleagues turned them into hallway jokes. One was shisolated. It had a defensible technical ancestry and the social prospects of a damp sandwich. Looking back, Duffy could explain exactly how the team had arrived there. He could also admit that it had taken a wrong turn.

The episode is a useful introduction to the co-founder and CEO of Pulumi. Duffy knows how much ingenuity can go into making a computer easier to program. He also knows ingenuity can make a terrible mess. His career has repeatedly brought him to the same uncomfortable spot: powerful machinery on one side, the person trying to use it on the other, and a thicket of unnecessary difficulty in between.

At Microsoft, that meant languages, concurrency, and developer platforms. At Pulumi, it meant treating cloud infrastructure as something engineers could program with familiar tools. Now it includes AI agents doing some of that work. The machinery keeps changing. His impatience with the gap persists.

A programmer learns to sell

His first glimpse of the possibilities came through a person rather than a product launch. At ten, Duffy encountered programming through his best friend’s father, Fred Brown, an IBM programmer. The revelation was that a computer could make games you had written yourself. He later recalled watching Brown code through a marathon weekend, astonished by the act of creating something from nothing.

He began learning C in his early teens. By high school, he was running a consulting business helping companies get onto the internet. He had to find customers, build their websites, and support them afterward. Duffy has recalled that his first customer’s site brought in more than $1 million in its first year. The revenue belonged to the customer; the lesson belonged to the young programmer.

Code could change a business. Selling the code meant understanding the business. He read Michael Porter, became interested in strategy, and carried the habit into jobs at EMC and Microsoft. Those two interests, software and enterprise, would eventually occupy the same basement.

The thousand-page apprenticeship

Before the basement, there was a substantial technical career. Duffy worked on Microsoft’s developer platforms and eventually led groups responsible for programming languages including C#, C++, Visual Basic, and F#. He helped with the effort to take .NET open source and beyond Windows. It was work on the instruments other programmers used to do their jobs.

He also wrote Concurrent Programming on Windows, published in October 2008. Its publisher lists 1,008 pages. A reader could reasonably expect a book about doing several things at once to take some time. The contents move from threads and synchronization to memory models, parallelism, performance, and the architectural consequences of getting those subjects wrong.

1,008pages in Concurrent Programming on WindowsPublished October 2008 · Addison-Wesley Professional

In 2009 he joined Midori, Microsoft’s research effort to rethink the software stack. Duffy led developer-experience work spanning the language, compilers, frameworks, concurrency models, and tools. The project explored how software could be safer, more reliable, and faster. It gave an engineer permission to question arrangements that established products had taught everyone to accept.

“And I wrote lots of code the whole time.”

Joe Duffy, reflecting on Midori

His retrospective writing is unusually willing to display the untidy stages. The concurrency design went through several major revisions. Ideas that initially seemed economical acquired complications. Colleagues using the system exposed weaknesses its designers had missed. Duffy credited that feedback with a breakthrough, rather than awarding himself the convenient role of solitary inventor.

He regretted that Midori had not been open source from the beginning and that the team had published too few papers. In 2015, he began sharing its lessons through a series of essays. A research project could end while its arguments remained useful. Publishing them gave other engineers something to examine, dispute, and carry forward.

A cloud company, downstairs

Duffy had long expected to start a company. Eric Rudder, another former Microsoft leader he had known for years, wanted to build something new too. They spent months working in Duffy’s basement, exploring cloud software before settling on infrastructure as code. Luke Hoban, who became Pulumi’s CTO, joined the early conversations and experiments.

By June 2017, Duffy had an explanation for the silence on his blog. He had been building Pulumi. He opened the announcement by assuring readers that he had not become a professional MMA fighter. The actual occupation involved distributed systems, programming languages, hiring, and a young company’s culture. There are gentler ways to avoid writing a blog post.

In June 2018, Pulumi stepped into public view with an open-source platform and a commercial service. The Seattle team numbered thirteen. Its investors included Madrona and Tola Capital, and the approach carried the imprint of people who had spent years making tools for programmers.

Luke Hoban, Joe Duffy, Eric Rudder, and S. Somasegar pose together in an office hallway
The basement years acquired company. From left: Luke Hoban, Joe Duffy, Eric Rudder, and S. Somasegar, pictured with the October 2023 funding announcement. Photo: Pulumi, via GeekWire.

The pitch had a practical appeal: let engineers describe cloud resources through programming languages they already knew. That would bring existing editors, libraries, and testing tools along for the ride. Familiarity was doing serious work. A company did not have to invent an entire programming culture before a team could begin using its product.

The languages were only half the argument

Duffy’s view of the cloud extended beyond provisioning a collection of machines. Cloud services had become ingredients of application design. Developers could build around managed databases, containers, and serverless functions, but the organization still had to connect those choices to the people responsible for running them.

In his account of Pulumi’s 1.0 release in September 2019, he described a divided workplace. Developers and operators had different tools and responsibilities, with too much friction between them. He wanted shared technology that respected their different expertise. An operations team could establish controls while developers used the infrastructure those controls permitted.

THE IDEA BEHIND THE INTERFACE
DescribeUse a familiar programming language
ReviewInspect the proposed infrastructure changes
Deploy togetherKeep team controls around the work

A simplified view of the workflow Duffy described around Pulumi 1.0.

This makes the language choice a social decision as well as a technical one. A piece of shared code gives two colleagues something concrete to discuss. They can review the same change instead of translating a request through several disconnected systems. The infrastructure still requires expertise. The conversation gets a better starting point.

In a 2022 discussion, Duffy compared the cloud to an operating system: software allocating and coordinating hardware on a much larger canvas. That comparison helps explain why he saw more work ahead. A scheduler or a virtual machine leaves plenty of room for tools that help people express what they actually want to build.

The manager is part of the system

For someone so interested in programming tools, Duffy writes a good deal about management. His 2016 essay on performance culture argues that software performance has to be part of daily engineering work. Measurements, tracking systems, and time to improve the product all matter. Managers have to understand and reward that effort.

He rejects the ritual of assigning all responsibility to one performance specialist while everyone else continues as before. He is equally impatient with blame. His compact rule is “no jerks.” Technical criticism should be constructive, respectful, and tied to making something better. A pointed graph is useful; a scapegoat contributes rather less.

That emphasis gives his toolmaking a human scale. A compiler cannot allocate a manager’s budget. A deployment system cannot make colleagues listen. Better engineering needs the machinery and the habits around it. Duffy’s published philosophy asks leaders to remain involved in the details without turning a difficult measurement into an opportunity for public punishment.

Joe Duffy at a Pulumi infrastructure-as-code conference booth
The argument fits on a booth; the engineering takes longer. Duffy in a photograph accompanying a February 2024 interview. Image via The New Stack.

New colleagues, same old questions

By October 2023, Pulumi had raised a $41 million Series C, bringing its reported funding total to $99 million. The business was expanding beyond its original infrastructure-as-code product into deployment services, infrastructure search, and AI-assisted code generation. The initial programming model had become a foundation for more products.

In September 2025, Pulumi introduced Neo, an AI agent for platform-engineering work. The company reported more than 3,700 customers at launch. Duffy committed a third of a 130-person workforce to building it, a significant allocation for a company of that size. The work included infrastructure provisioning, compliance, and maintenance, with controls over the agent’s autonomy.

The development has an amusing precursor. On April 1, 2025, Duffy published a deliberately playful post about “vibe clouding.” The date mattered. So did the demonstrations underneath the jokes. He was exploring natural-language instructions and quicker iteration while enjoying the vocabulary of a software industry briefly determined to do everything by vibes.

His May 2026 writing laid out a more systematic direction: agents working through infrastructure tools, with people retaining visibility and control. In August, he announced a research preview of Neo Security, applying an agent to threat modeling and attack paths across cloud resources. The growing ambition was accompanied by familiar engineering concerns about context, review, and consequences.

There is a recognizable progression here. First, help people express complicated systems in code they understand. Then make that code useful to a new kind of participant in the workflow. Each step increases what the tools can do and raises the importance of knowing what they have done.

Duffy’s old Midori essays remain a useful companion to that ambition. They preserve the wrong turns alongside the good ideas, including the unfortunate keywords. Simplicity took argument, experiments, and colleagues prepared to point out the trouble. At Pulumi, the computers have grown considerably more conversational. The need for that kind of engineering judgment has kept its job.

Keep the conversation going

Read Duffy’s personal essays and Pulumi writing. Follow him on LinkedIn, Twitter/X, or GitHub.