MCP Security, Framework Fatigue, and AI Agents with Will Johnson (Presented by CodeRabbit)

0:00Welcome to St.Tat. Welcome to a brand new episode of the front-end happy hour podcast. Welcome to this week's JS Party. Live from Ship Shape Studios, this is Whiskey Web and whatnot. With your hosts Robbie the Wagner and me, Charles William Carpenter the third. That's right Charles, we drink whiskey and talk about web development. I mean, it's all in the name, it's not that deep. This is Whiskey Web and whatnot do not adjust your set. Whiskey Web and whatnot is brought to you by...

0:41Code reviews are critical, but time consuming. CodeRabbit acts as your AI co-pilot, providing instant code review comments and potential impacts of every pull request. Beyond just flagging issues, CodeRabbit provides one-click fix suggestions and lets you define custom code quality rules using AST prep patterns. This catches subtle issues that traditional static analysis tools might miss. CodeRabbit is the category defining platform for AI code reviews.

1:06Built for modern engineering teams navigating the rise of AI generated development, CodeRabbit's context-aware reviews pull in dozens of points of context, making them the most comprehensive AI code reviews. With customization features that allow you to tailor your review to your code base, CodeRabbit's comments improve with time and interactions. CodeRabbit helps organizations catch bugs, strengthen security, and ship reliable code at speed. Trusted by thousands of companies in open source projects worldwide, CodeRabbit helps reduce review time and bugs by 50%.

1:36Hey, what's up everybody? This is Whiskey Web and whatnot with your hosts. Robby the Wagner and Adam Thomas Argyle, the nerd. I'm here y'all, what's up? We are all here. We have a guest here. Would you like to tell the folks who we have here, Adam? Oh, yes, I would. Today, we have senior developer advocate at AuthZero, aka head instructor of so many lessons the site had to show pagination. K-pop team and hunters karaoke trout, kripper, rad dad, and killer web developer. Welcome, Will Johnson.

2:10Hey, everybody. Thanks for having me. Thanks for coming on the show. Appreciate it. Yeah, no problem. I'm glad to be here. I got my, I got my, my Jameson nice three triple triple triple triple triple triple. Hey, three three people on the show with three triple triples. Yeah, it's time to crack it open. Yeah, all right. Yeah, they get that pop. I'm kind of surprised this is twist. Is Jameson usually twist? Maybe they're just precise like that. So yeah, this is the triple triple. It is called that because it is triple distilled in triple casks of bourbon, sherry, and chestnut casks.

2:52It is something proof, 80 proof, and it is 80% corn and 20% melted barley from what I hear and four years old, I believe. They should have gone with three. Then it's a triple triple triple. Oh, I see. Yeah, keep the triple going. Yeah, three three three nine. If you're triple triple three times three triple triple. Yeah, nice. Yeah, three times three times three though. That's the really expensive one. The 27 years. Oh, this tastes different than I thought it would.

3:22Wow, that's got a lot going on. It does. No bite. Lots of sweet. Very true, no bite. Yeah, not in town alcohol. Definitely a lot of different woods. Low sweetness from the sherry, I think. I don't know. Having a hard time picking out particular notes. I've been really enjoying smelling an empty glass because then I feel like I get this more true, true scent of what's in there. I don't know. This is good that says. Well, influence ourselves here. It says toffee, cacao, and toasted almond.

3:53Also, there is, okay, that's on the outside. There's a spider crawling on the outside of mine. And I was like, are you on the inside? How are you alive? It's like that tequila that has snakes and scorpions inside? Have you seen those ones? Yeah, those are nuts. That's nuts. They was in like a lot of 90s movies. I thought I would experience that like a lot more than I've did, but I haven't seen one in person, but there was always in 90s movies. I haven't seen one in person either.

4:22I saw it in that TV show. Three sheets to the wind. Do you know, do you all know that show? It was this guy. It's actually very apropos for this show. This guy went around it and drank beer around the world. Actually, it wasn't just beer. He just got hammered everywhere around the world. And so he would find the locals. And he'd be like, what are you drinking? They should have. But yeah, three sheets is a reference to getting super drunk. And so he'd go to all these places, get hammered with the locals, drinking whatever they drink locally.

4:50Whether it was like a local rum was the thing that they were known for, or if it was a whiskey that they were known for, or a beer. And so then the next morning, he would then have the local hangover remedy. So that was the whole episode. Was you see him basically going from bar to bar and distillery to distillery, learning the history about why this place has this particular booze in this area, drinks a lot of the booze. Never really like stumbles around.

5:13It gets, you know, ridiculous, whatever. And then wakes up and up. But in one of those episodes, okay, sorry to bring it full circle. He drinks some of the rums that have snakes and stuff in them. And they just looked so gross. I was like, there's like a dead body in that thing. You're just going to pour it out and drink from the dead body juice. I'm like, that's death juice. Okay, that's fine. It was a good show. Yeah, I mean, it sounds. And there was especially the hangover cure part.

5:37Yeah, very funny remedies. Yeah. Sorry, I was going to say we have a rating system for whiskey on this show. We'll do it real quick before we forget. Zero to eight tentacles. Zero being the worst. Throw it out. Wouldn't clean your toilet with it. Eight being the best. Clear the shelves. Drink it. Nothing else. Four or five-ish middle of the road. What do you think, Adam? I'm liking it. I'm also tasting a little bit more caramel as we go in. I also kind of feel like I tend to get a lot of caramel.

6:04But it's just from that like sweetness, a little sticky. That's good. This one is better than the Jack Daniels Reserve from last week, which I gave quite a poor rating. I'm going to put this one in like a five and a half. I'm not sad. It's, yeah, the lack of bite is kind of, it's good. It's got a nice smoothness to it, which is nice. Cool. So anyway, you have five and a half out of me. Nice, nice. Will, what do you think? Well, honestly, this is my first whiskey ever.

6:28Get out of here. What? The fact that it is. So the fact that it didn't burn, you know, like I can actually like just drink it and, you know, kind of chill. I like that. So I'm going to give it a seven. Nice, nice. It's nice. I don't know if we've had a lot of Irish ones on the show. I think this one is a lot more interesting than a couple of Irish ones I've had. I'm going to say, yeah, we'll give it a six. Pretty solid. Nice. Plus my son named James and so.

6:57I was just going to say you got to tell the story of why we picked this one. This is not an accident. Also, like it's just like the cat out of the bag there, though. So they can, you know, can't create any suspense. Yes, this is your kid's name. My best. That's okay. All right. So we have some lukewarm takes that we usually do on the show. We'll start with a fan favorite. Get rebase or get merged. I know rebase get a lot of heat, but let's go. Let's go rebase.

7:30Nice. I think you're in a rebase friendship zone right here. So I used to merge, but you know, now I rebase, although it work. It's called a re-stack. It's really annoying when you kind of go into these other environments that have get workflows, but they want to rename everything. Man, it's annoying. It was at Chrome too. When you're working on Chrome, you didn't really get normal get commands like everything was abstracted in some way. Shopify, we don't rebase.

7:56No one even says rebase. They stack. We re-stack or I'm going to stack off your stacker. Anyway, I don't mind the word stack. It's kind of nice, but still. Like, hey, rebase is the way. Yeah, it at least makes a little sense. It's not like, yeah, I'm going to pizza. Like, what? Oh, we lost a wheel. He didn't like my joke. He's got a hang in there. He was losing connection a little bit. So maybe got disconnected. Where he did what I was supposed to do.

8:25Sponsored by Verizon Fios. Sponsored by the sweet light fixture that I need behind me to eliminate all my stuff. Yeah, you're cool. Do you have new? You've got like a... I changed the colors. No, I'm standing up so you can see my shelf. Usually you can't. Sick looks good. Yeah, you can almost see the Ember sign. It's right there. Says Ember. No one will ever know. Camera's too good. I can't read it. Live on Twitch just to you and I together. Yeah, I don't know what to do with my hands.

9:07Do you ever do the dad hand hip thing? I hate it. I do it all the time. I'm like, oh, my hands are on my hips. There's got to be a cooler place to put my hands. And it's not on my hips. I put them in my jacket pocket. I'm like, yeah, I'm still cool. I'm still young. I'm not a dad. I don't put my hands in this. You mean like the scolding pose? Yeah, man, like that. Yeah, just kind of, yeah, I'll just walk me like, what do you think you're doing? I'm like, I'll crap.

9:31I'm doing the thing. I got my hands on my hips. It's ridiculous. I'd all find myself doing that. Yeah, I usually go pockets. It depends on what I'm wearing, I guess. But I haven't had that issue. Pockets is good. I mean, I had a fun parenting thing the other day. We're like, they've been wrestling a lot more. Right? I have like two boys right? So they're like wrestling a bunch and usually someone cries. And then they go, oh, we got a wheel back. Anyway, my kids were beating so weird.

9:55That's the weird thing for your kids to say. Yeah. I got a wheel back yet. Oh, they were beating each other up, though. And they didn't want to get in trouble, though. They'd been getting in trouble a lot for like hurting each other. So like now they hurt each other and they suck it up. And I was like, that's good, though. I was like, yes, become stronger. My children are wrestling and I suck it up. Yes. So yeah, mom's out of town. So there's no one to cry to.

10:18Because dad usually goes, oh, you hurt yourself wrestling. I was like, that's what you do. I'm like, I'm not here for that. Yeah, it's kind of funny like seeing things from the parent perspective. Because there's like, I've been through this a hundred times. And I know it's not that bad. But this is like your first time and it's so serious. And I'd be like, yeah, this is what happens when you wrestle. When you jump down six stairs, your legs want to hurt.

10:45Like this is the process. Yeah, I feel like it's tough because a lot of parents, you're on one side of the other usually. It's like, don't police it at all. Just let them get super hurt and they'll learn. Or like, you're trying to keep them from getting hurt. Like from everything. And I don't know. There's not really a happy medium. Because if you protect them sometimes, and they don't understand what getting hurt is. And like, yeah, I mean, like our son is like, oh, a knife.

11:10Like, let me just grab that by the sharp part. And I'm like, why don't do that, please? Like, I just told you not to do that. Yeah, you definitely, I think the world is your kid or your kids. Do you have one or two? I can't remember. My oldest is, oh, you're way off. I have six. So my oldest is nine to two. I am off. And this is eight. Dang. Yeah, you're ended on all sorts of stuff. Okay, so yeah, I'm seven and nine. And his are like all under four, right?

11:41Yeah, Finn is three and the twins are seven months today. Twins, cool. I want, we wanted twins. Didn't happen. But yeah, it's, uh, I mean, it's fun. But it's also a lot like, they're never calm at the same time. Or actually, we jump into more takes. What do you think? Dealer's choice. Adam, you got one you want to do? Yeah, well, I mean, I'm this, I'm partial to this one. I was reading an article the other day where someone said what I wanted them to.

12:08So will this is a question for you to say what I want you to or to say what you want? You get to know. Is CSS a programming language? Oh, man, that's a great question. Now, is it a programming language? It depends on, I guess it depends on how you're using it. Because there are some things that you can programatically and mathematically do with CSS. But, you know, if you're just, you know, making a button round, I don't know. But if you're like making it change to how wide the pages and stuff like that, I feel like you are doing some programming there.

12:45So I guess it depends on what you're doing. That answer rocked my face, man. That was, I think that might be one of the best answers. Because yeah, you're right. If you're just changing the color to red, and you know, everyone feels successful, you're not necessarily a programmer. But you did write some code, I suppose. But if you're like legit writing loops and you're filtering over stuff and you're doing something very programmatic, you're using trig functions, well, then you're definitely, so the person, the article I read was a hacker.

13:12The hacker was like, hey, look at what I can do with CSS. CSS is one of the next best things that you can use than JavaScript to do your hacking. And they came up with this new hacking exploit using CSS and all this kind of interesting stuff. And they were quoted in the article as saying, CSS is a program, which like look at, look at what you can do. But yeah, maybe that should be the measurement. If you can exploit something and get into a system with it, it has to be a programming like, yeah, that's pretty deep to do that with CSS.

13:43Yeah, yeah, I would not have thought of that. Today, my wife was looking at architectural digest to look at a color of a wall. Like there was a picture she had seen. And we load the page, all the pictures and like, text come in for like a second and then go away. Because it's like, you got to pay for this. And I'm like, wait, so they're there and you remove them now. Like you guys used to throw a like thing up over it. I could delete it. I was trying to find my way around all the stuff, but they like programmatically delete all the chunks of the page.

14:12They got like 25 little JavaScript scripts that like, delete everything. And I'm like, holy shit. Like this is some, it's good stuff, guys. Bravo. It is intense. Yeah, that's like those read more buttons where it's like, click the read more and then it just expands. I'm like, I'm going to do that myself. But you're right. If they are deleting or it's not even there, it's a totally different story. Yeah, I was impressed. What are you doing at a Auth0 right now, dude?

14:39And how long you've been there? I mean, at Auth0 for like four and a half years. I think I have four back in August. So yeah, I don't know. I have four, like almost four and a half years then. It's been a good ride. Just, you know, especially now, I think I'm having the most fun just because of, you know, the changes, you know, with AI becoming like more prevalent and, you know, finding the ways to like, you know, secure AI and tools that we use like wanted to try the, what I've been into lately is like MCP security.

15:12Because MCP, you know, it just had its year birthday. I mean, it's been like a lot of changes with MCP and like how they do security and they're like, you know, still trying to figure it out. So it's been kind of cool like watching like that whole, you know, process of like, okay, we're going to do this. I don't think that's right. Let's, you know, try to do something different. Like one thing is like a big thing for like a few months was like dynamic client registration, letting the MCP servers like register on their own.

15:41Then they was like, hold on. That's like way too free and then every time, you know, someone registers, you know, it creates like a different instance, even though it might be the same person. So now they got like two different identities or 50 like however many they end up using. So like just recently this beg introduce something called CIMD, which is client ID metadata documents. It is basically like a URL where you kind of like host your identity for your MCP server.

16:09Then it like validates if it actually belongs to this user. So kind of I made it more secure and then it didn't make a new one every single time you try to like register my MCP client. So that's lately what I've been into just checking out the MCP security stuff. Nice. Yeah, I think that is a there's a lot of security things that are going to come to light with AI that people are just like, oh, it's a paradise. We can just, you know, get all this stuff for free and everyone can do everything and, um, yeah, that's bad when everyone can do everything actually.

16:40There's a lot of security vulnerabilities that it seems like you can charge a lot of money through an MCP server too. So you got to that's why you got to protect them. So a lot of people have tokens that you have to so you go buy your token to give you even access to the MCP. So I'm sure a bunch of people are like, oh, I'm going to get around your token. What are some of your favorite hacks that you've seen? Are there any funny ones where you're like, you know, have like a silly name like the midget on your back hack.

17:05And it's just like, it's like a little midget AI that's on the, I don't know, I'm making, I'm making that up. But I'm like, are there any funny hacks that have happened to MCP server server? Yeah, what's up? I mean, not that I've seen, I haven't seen any funny ones, but I've definitely seen some ones that made me like, second guests like every like new tool that comes out. So I'm not going to name any names, but there are like lots of exploits where you'll like download a CLI and it'll somehow they find they even bypass the check that there's like a, that there's something like a, you know, malware or something in it.

17:37It kind of like approves itself and then it'll, it'll like run another program through your like AI agent in the CLI and you literally won't have any idea because it deletes his history of like, what it does and stuff like that. So I've seen some pretty intense ones, you know, that that calls a lot of like hiccups. So now when something new comes out, I'm definitely not the, I'm not the first person to jump on and not not, not even know like a personal machine like I'm waiting.

18:05Yeah, yeah, that's fair. I mean, that's anytime there's new stuff. I feel like everyone comes out of the woodwork to do that kind of thing. Like NFTs had that problem. Like, oh, yeah, a contract. Let me sign that. Oops. Like, yeah. So I think like, you know, people are waiting for the new thing to have a little bit of hype and then like steal as much stuff as they can as fast as they can and get out of there. Yeah, exactly. Also, I've heard through the grapevine that MCP had its year and that might be its limited set of 15 minutes of fame that it had because skills are where it's at.

18:39Can skills also hack someone? Have you found any exploits through that mechanism? So far, I haven't found any or heard of any at least. And like, I do look in quite a different like communities and for like, you know, like cyber security and stuff like that to see what they're talking about. So far, I haven't seen any so, but you never know what might happen as a like game popularity type thing skills are. I fairly knew like a month or two old MCP is not necessarily old, but it's a year old and it's getting more hype.

19:10So more people are, you know, it's becoming like an attack vector because more and more people are talking about it. More people are releasing servers. So if the thing, same thing happened with skills, then you know, might start to see more traffic. But as of right now, I haven't seen anything going on with that. Cool. Yeah, the only hack I saw was that if you dynamically create your skills, the skill that you created could be full of stuff that you didn't intend.

19:36And so then every time you use the skill, it's coming with all this context or all this personal information that you didn't think it would. And I don't know, submitting it somewhere. But interesting. So you're following all the MCP hacks. Since you see the next JS news that came out, everybody freaking out to update their builds. Yeah, yeah, I did see that. I did see that actually wrote a, well, I don't know, that was a different blog post, but I wrote a blog post about the next JS updates from like a couple months ago.

20:04But yeah, I did see the vulnerability that they had and just make sure you update your package as people. We're doing a lot of that going around. I don't know, which one's better to update constantly or to not exactly. Well, I think in this case, you might want to update. But yeah, I get what you're saying, because then your update and then something else goes wrong. Yeah, always be updating. That's what I do. Just PNPM update. Every time you pull down the code, just update everything. That's fine.

20:34That's what they want you to do. Robby, they want you updating. Twitter will tell me if there's a problem. It's okay. Updates. Yes, Twitter will tell you it's a problem several times. So if your kids are that old, how is K-pop demon hunters so popular in your house? Are you the main driver of that? No, I think it's all of us. I mean, the youngest is eight and then we got teenagers. So I wouldn't say that I'm the main driver. It sounds like a, it's just a whole thing.

21:03I think like, you know, the music is good. You know, it's funny. It's goofy. Yeah, I didn't spend my son. So like as much as they do, like them walking around, singing soda pop or your idol or anything like that. I didn't expect that. But yeah, I think that is just, I don't know. For me personally, it hit a lot of nostalgia notes. So you know, 2000s, you have like, Britney Spears and like in sync and then like the boy bands and like B2K and Chris Brown and like all of that stuff.

21:31So that was like my like era, like my heyday. So even like when just like when they decided to boys were formed in the street, I'm like, that's something somebody would have did and like, you know, 2002 or something like. So it just hit a lot of nostalgia beats for me. It is really good. Robbie, have you seen it yet? K-pop demon hunters. I have Caitlin and I watched it because I wanted to see if we were going to let Finn watch it or not. It doesn't have anything that's like too bad.

21:54But there's just enough of like, I don't remember the exact word. It's we're like, I'm a kill you or like whatever. We're like, we don't want him being like, I'm a stab and kill things like they do with like the hands or whatever. So like he already does that. I don't know where he got that from. Like we never stop it yet. Yeah, guns guns show up. You're like, I don't know where you learned about guns. But as soon as they just smell the concept of a gun, they're like, look at the power.

22:18And they just go around and I'm dating you. You're like, dang it. This just in whiskey.fund is now open for all your merch needs. That's right, Robbie. We're hearing reports of hats, sweaters and t-shirts as well as a link to join our discord server. What's a discord server? Just read the prompt or man. Hit subscribe, leave us a review on your favorite podcast app and tell your friends about our broadcast. It really does help us reach more people and keeps the show growing.

22:47All right, back to your regularly scheduled programming. Yeah, but I mean, it's definitely a great movie. I feel like, you know, it got so much hype because the music is so good. And I feel like it was a easy gateway into K-pop for people who hadn't listened to anything K-pop before, because like K-pop listens to a good bit of K-pop and like, it's all pretty dang good. But like, I think if you hadn't heard it before, you're like, oh dang, this is really good.

23:14Yeah, yeah, for sure. I think that it's a good gateway. Yeah, I was initially turned off by like, the name on my mind. How did you get turned on, Will? No, I was initially turned off by the name like, K-pop Dema Hunters. That sound, it just sounds like that's the cringiest thing to ever exist. And then I had like a mental picture. Yeah, completely different of like, what it was going to be like. I thought it was going to be like that. You know how the modern animation is like really bad in comparison to, you know, the cartoons we grew up with or whatever.

23:46So I was like, I just had it, it looked really bad in my head. And then my daughter was like, she watched it, and she was like, do you want to watch it? I think she was like, I think you might think it's cringed. Like, she wouldn't even sure if I would like it, but I mean, first five minutes I was, me and my wife, we were locked in. Like, it was good. So, yeah, and I think that, I think that's my favorite part about it is that it came out of nowhere.

24:09Like, it didn't have a big market in push. It didn't have a big hype. It showed up on Netflix. You're like, this is the worst name ever. What is this? Then you click it and it was a quality film. And I think that's why it, like no one told you was good. You have to figure it out on your own. I think that was like the reason why I got so popular. Nice, like a band that you found. Yeah. Yeah, I'd be like naming a movie, this movie sucks. And like, people would be like, well, does it?

24:35I got to see now. Like, yeah, exactly worst movie ever. I would ask if I see nothing about it and I seen that title, I would have to click and check it out. Yeah, for sure. I heard the person that wrote a lot of the songs and that sang and it got kicked out of this music school that they were in. So, it's like, apparently there's like really competitive K-pop music schools. And this person got kicked out for whatever reason for not performing well or not doing well.

25:08Apparently, sent them into this state of payback or whatever, they just wrote all these songs and performed them and kicked a bunch of ass and all of a sudden now they're just probably like, in your face, they're just going around. Yeah. You kicked me out and now I have a trophy, you know what I'm saying? You were wrong, and you were wrong. And you were wrong. Yes, spiked it, spiked driven song development. I like it. Yeah, yeah. It kind of works.

25:36I got told that I wasn't going to go to Stanford in high school and I was like, screw you, man, I'm totally going to go. And I didn't go. But whatever, I tried for like a year just to piss that guy off. He was right, though. Yeah, that is how it goes. Just try to do what people say you can't do. Robbie, why did you write? Moana looks like use effect. I found sit on Will's Twitter. I don't remember. It was something like this Moana live actually would be looks like use effects or something.

26:05Tell me more. That's amazing. Okay. Oh, man, that's funny. So the lower behind that, so I don't know as y'all know, like on the, it's mainly a sports thing. It's mainly a sports Twitter thing. So, you know, if a player is bad, they'll say that they're ass, right? They like, oh, whatever, whatever is ass or whatever. So now when something is bad or ass, they'll say like a song, they'll be like, oh, man, this song is Dak Prescott. Like, so that's kind of like how they do it.

26:37So I seen that in the Moana live action looks bad and everybody's been talking so much trash on use effect. So that's what I'm saying. Like use effect is ass on like that. This looks to use effects. So I know nobody would knew what it meant, but I just wanted to say it anyway. So that's that what that came from. That's a great use of Twitter is to say something that's like, I don't think anyone else is going to know. And you know what? I don't give a shit.

27:03I'm going to say it anyway. It's just like vague proclamations. You're like, I know context. Here's a few words figured out. I love it, dude. Yeah, now that I know the explanation, I really like that. But it might not understand. It's like when I came back from Japan and I was like eating fruits and vegetables as they come out of the earth is like using the web platform. Eating a meal that had got ground up and bashed up and powdered up and then reformed into a poof.

27:31And then he put a bunch of preserves and a bunch of more stuff that you had to shove more stuff into it. And then you have this basically mishmash thing that you eat. That's react. And it's like Americans eat like react in Japan. They eat like the web platform. Your statement there reminds me a lot of that. We're like, I'm going to extrapolate this weird thing into this completely other unrelated weird thing because my brain is weird. And I'm going to share it.

27:57It's awesome. Speaking of mashed up preservatives, I saw your tweet about sugar-free Oreo. Or your retweet of their ingredients or whatever. Yeah. How do you feel about that? Just give me the sugar, man. What did I got to see? What did I respawn? Because I know I said some emojis. Okay, yeah, because it's like we're removing the sugar. Like first of all, I don't have the tweet up because my computer's going to really slow. I'm not going to look on my phone.

28:28But two of the ingredients end in like a sugar word like Dextrose and whatever, whatever. So like bro, it's still sugar. Yeah, it was like sucralose, polydextrose, that's still sugar. Like it's not table sugar, but it's still sugar. And then just give me the sugar. Like, malice, a doll, polydextrose, sucralose, an ace-k, have her play sugar. Bro just give me the sugar, man. Like we're like, okay, because you're saying Oreos are a reactive component.

29:01That's what I'm hearing right now, because it's not really food. It's just all the weird stuff and turned into something that I'm going to give you to eat. But I love the way it is. Exactly. Give me back a component did mount. I don't need hooks. I mean, I remember, I said something similar to that. No, it was like a, I was talking about, it was like on a Twitter space and I was like, dude, I was like, just give me jQuery back and like the whole chat went silent.

29:33But I mean, you just lost so much followers. It was more like straight forward to use. It sure was. Yeah. My own model skin called bling bling. I'll go ahead, Robbie. Nice. Yeah, I used to use Ken Wheeler's cash. I thought that was pretty good. Okay, that's why I had bling bling. So there was cash. There was bling JS. And then I had bling bling JS because I went all ES6 and I had this really tight. It was like nine lines of JavaScript that recreated like the core parts of jQuery.

30:04I thought it was so cool. And it was fine. Yeah. You should resurrect it, man. It can be the, uh, the next K-pop demon hunters in the web that were still alive. Yeah, there you go. Yeah, I mean, I feel like we went too far in like the way front end works now. Sometimes there's a use case for really intense frameworks. But like the astro model of it's all vanilla JavaScript CSS HTML. And then when you need complex stuff, you have maybe one, one little component that has like some of that in it.

30:37But now we're just like, oh, yeah, I got to like have a router or a route. And it's like, oh, that's definitely a component. Like actually, it's not a component because it's, uh, it's a router. So it's like, I don't know, trying to fit everything into components and being like, it all has to be like, oh, it can also render on the server or the client or both. Or who knows where you are. It's like, yeah, maybe we, like, maybe we went too far. Yeah, it's like, you know, you want to, you know, you want to cover.

31:07I think that really comes from just like covering as many use cases as possible because, you know, it's going to be a watering to people using the product. So like it, you know, are the framework or whatever. So like it makes sense. But then people see that and think that that's how they should, you know, do it from the jump, you know what I mean? And then it continues to you, you know, over engineered and over engineered. And you're adding this and you're adding that when you didn't really need all of that.

31:32What's the best engineered thing you've ever seen or used where you were like, this is just the right amount. Oh, man. You know, bath zero. Well, what a great answer. I can't believe you said that. For me, though, it was, it was rails, man. I remember when I used rails, I like legit, and I was like, dude, I can start a business with this. Like it was so cool. It was like so easy to understand. And Laura was kind of the same. Like I haven't used it a lot, but I've dabbled in Laura when it kind of has like the same experience.

32:03But rails I thought was, I use that when I work that egghead. And I thought that was like for me personally, a great developer experience. I could grok anything about it that I need to in a fairly short amount of time. And I could look at other people's code bases and kind of know what to do and where to go. So I really, I really enjoyed the rails experience. Do you have to manage any of the integrations for Osiril? Like sometimes DevRel have to do either bug fixes or patches or releases or something like that?

32:33Or are you involved very much in the interfaces that go into these frameworks? Or are you? No, not on our team. So like we're separated into like different ways of DevRel because you know we're a big enough work. So like I'm specifically content, you know, videos, podcasts, blogs, stuff like that. We have a team that's community focus where they go out and do events and they throw events and stuff like that. And then we have like another that does like that stuff like works on the SDKs.

33:02And sometimes we'll help out and help out with Dyson stuff like that. But yeah, in my particular role, yeah, I don't work on the SDKs or anything. The main thing I do is like give the feedback back when I'm out when I'm because people are, you know, in my inbox, you know, like, hey, this isn't working or and honestly it's been some pretty cool stuff coming in my inbox. Like things not working that we didn't even like know about. So it's been kind of cool to be out there like that and, you know, be able to hear from the community and fix things because, you know, they're hacking on stuff and trying stuff.

33:32And so I get the, you know, see like what are people doing? How are they making this work? And it'd be like, well, it shouldn't work like that. Let me see. Why are you having to make this hacker? You know, why are you running into this because it shouldn't work that way? So that's been kind of cool. We fixed a lot of things just from people being in my DMs. Either complaining or just showing me stuff and they didn't even know that it was a hack. They were just doing it.

33:55And I'm like, oh, that shouldn't happen. Let's get that fixed. Yeah, you don't want hacks in your authentication. If you want them anywhere, that's not the place. Yeah, exactly, exactly. So I'm glad that I get to be available out there like that. So people can feel like, you know, they got someone they can talk to when they're having any issues. So that's like one thing I do enjoy about the day of real role. You've been there long enough. What's your like really tight pitch that you have when you're like, oh, yeah, I can pitch austeroan one or two sentences and make it sound good.

34:28Make it make it about 60 seconds and then tell us where to send the invoice to. I mean, I can tell you where to send the invoice to. Yeah, all zero is the authentication and authorization platform for developers anything that you need to do without the indication and authorization, whether that's connecting social login, securing AI agents, we handle it with our SDK. So you don't have to. So you can get back to doing the fun stuff. You like like programmatically hiding stuff with CSS.

35:06Well done on the fly integration with my preferences. Nice. That's good stuff. I really like past keys. The past keys work. Yeah, past keys work. And our integration was pretty simple. Like it's just a just a click of a button in the in the dashboard and you got past keys. There's like someone on Twitter who has like a brigade against past keys. So it's like anytime we post something on past keys, they're like right there talking about how bad it is.

35:37It's been like and the consistency is insane. Like I would like to be dedicated to a mission like like as intentionally as that. I don't understand how past keys work really because it's supposed to be more secure, but like it's way easier. I can just like save it in my one password and log in with that past key on like any device, which I think kind of breaks the way it was supposed to work. But one password can emulate a past key. Yes, yeah, you can save it there and use it on every device, which is dope.

36:11So like it seems like it'd be counter like it'd be against the ethos of how it was supposed to work. I'd like to just have another device and it's supposed to like use biometrics or some kind. Yeah, yeah, but it's like, nope, you can biometric into one password and that counts, I guess, and then you just say, oh, it just works. That makes sense. So you still have to bio into one password in order to get there. Okay, so there's still a bio check. There's still like something kind of still fingerprinting you in a way that's like pretty physical.

36:42Okay, yeah, but like it's a little less concerning. Yeah, you know, it's a public and private key pair. So like the private key is stored on the device or I guess in one password, I'm going to be honest, I'm not familiar with how one password does it. But if they store it there, then like no one should have access to that. Just like if it's stored on the device, no one would have access to that like, you know, from the way. And so they check against each other and then if it matches and then that's why it gets you in.

37:10And so as long as no one has the private key, that's stored like on device, then you shouldn't have any issues. But I get why it seems like because it's not just the pass key. If it was just the pass key by itself, just out floating on the internet, I understand whether I'd be concerning. But it has to have that match in order for it to let you. Yeah, yeah, makes sense. It just feels too easy. When stuff is easy to log into, I'm like, that don't feel right.

37:37Yeah, yeah, I get what you're saying. I get what you're saying. Yeah, I think even me, like, before I start working at off zero and I didn't know how it worked, I was kind of like the same way. I was like, oh, I'm never using my Face ID or fingerprint. But now, like, I like use it for every, like, now that I know how it works and what it does, then, like, I don't, you know, I have no issues. Yeah, office is so weird. It's still mostly unsolved. We have more services and more options.

38:05But we're not necessarily in a scenario where it's impenetrable. People can still lose stuff. They still ask people to store backups and on their computer and like, it's like a basically a sticky note you stick in your hard drive. Yeah, that's more secure here. Keep the sticky note in your hard drive. I'm like, okay, that's totally not recognizable by CLI if it wanted to crawl through. But funny, I mean, it's kind of nice, though, that they're all out there.

38:28You do trust a SaaS service for your authentication because there's just too many considerations. It's kind of like your CSS. You just trust specialists is kind of the deal at the end of the day, right? There's too much niche information these days. Computers feel simple only because specialists have made all of those things feel that way. We're in a very pampered scenario a lot of times. Auth is one of those scenarios. Auth is just pampering devs.

38:54There you go. It's Pampers for devs. Auth Pampers. Yeah, exactly. Soft, cloudy Pampers. Dipers for your login. And that's kind of like the fun about it too. Like, I've been here for four years and seen so many different iterations of like, past keys was like a big thing. And then when there was a whole web three thing going on in like using web while it's to log in from all people, that was going to be like the way people log in that was like a big thing.

39:28I know people say auth and it usually means like authentication like by itself. But then there's like the authorization part, you know, of like permissions and what they're like allowed to do. And that's like, you know, ever evolving. So it's kind of been, you know, interesting to see like that change, like going from like role-based authentication then relationship based authentication or authorization my back. Even I get them confused some time.

39:54But yeah, like going from that and then like there's things like FGA like we have obviously zero FGA that's based off of like the Google Zanzibore. So that's like fine-grained authorization when you think of like Google Drive and does the team have access? If Will is Adam's manager does Adam get access to this document instead of giving like everybody their own things and stuff like that. So that's also been like interesting to see that like you said it hasn't been solved yet because there's just there's so many things to consider.

40:26There's more and more users every day. There's more and more people attacking every day. So it's been like an exciting space to be in just to kind of watch all this evolution. And still like not know like what's going to be the winner, right? Like even, you know, I still don't know who's going like another these things. I don't know what's going to be the off winner because yet Pasky's is hot. But it might be something else that come out two years from now.

40:50So it's been fun. Yeah, always evolving. Yep, you make authentication sound cool. But you're right, it's not, it's not done and even permissions are still not solved. Like that's one of the hardest things. You go into AWS, you go into Google cloud services, you go into Netlify, you go into your Google doc and you're like, who has access to this? I was just showing my kids this the other day and they're making a Google doc to make their own Pokemon cards.

41:12I'm like, hey, you do data entry, you define the Pokemon name, the HP, it's moves and all that stuff. I'll make you a card. And so then they go in there and like they got a couple cards ready and get a share. And it's just that stuff is so complex to them. They're just like, what is going on with permission models? Like, why do you need access to my thing? And I'm like, you should give me limited access too. So funny. Yeah, I think like the Google stuff is kind of like the best way to teach someone like that because it has so many different options and it kind of shows you just how granular it can be.

41:43Yeah, what would you like to plug, Will? What do you got going on? I'll zero, I guess, but like, you know, where can the people find you? Yeah, what do you want to mention before we end? I mean, you can find me on Twitter at Will Johnson IO. I'll join that thing, the name, weightless thing because I want to get the IO taken off. So it can just be Will Johnson. The other Will Johnson hasn't used Twitter in like eight years. So wish me luck and get into but for Will Johnson.

42:10But for now, it's Will Johnson IO. And someone I like to plug. I mean, you know, definitely the off zero AI stuff. So we just lost into like general availability, the off zero for AI agents. You can get that at off zero.com slash AI. And it's basically authenticating your agents, giving them the proper permissions to access things, storing like your tokens and API keys. So you're not giving them to the AI agents yourself, which I've seen people do.

42:42So please don't do that. Use token vault and, you know, save those somewhere securely and, you know, let the exchange happen without zero. So you're not liable. And also we have like a notification system. So if you want their agent to like a sensitive action, it can alert you whether email, phone call, the text notification, like whatever you choose for you can actually approve it before it takes that action. So yeah, you can check out all that stuff.

43:07We got quick starts, doc sample apps, all of that off zero.com slash AI. Nice. I have one final question. Is AI users or are AI users? Are they users? You gave them permissions. But how do you put that in the database? Because they're not people. They're just, I guess they're not count. I don't know. Seems weird. But now we have AI logging in and doing all these things. They're called agents. They're saying, yeah, you can't see them. You know, they can never ask for stuff.

43:36Like are they a primary about like in your analytics? Are there more agents signing up every day than people? Is that like a thing that even happens? I don't think it was this more agent signing up than people, but I feel like a lot of people are using agents and kind of letting them do stuff. So that's kind of why we came up with the off zero for AI agents just to kind of reign it in. It'll get assigned, you know, an identity and everything like that.

44:02So that's how like gets kept track of and you know how their permissions get, you know, the guard rails get put on and everything like that. Makes sense. Yeah, that sounds smart. I'm sure a lot of people were just giving it like a, they made their own account and gave it their credentials. And like, oopsie, it broke some stuff. So yeah, that sounds better. Yeah, that's pretty much what was happening. I mean, I even seen like conversations on Reddit and someone was like, are you guys just giving your API keys to the agent?

44:32And it was like hundreds of replies and most of them were like, yeah, I'm like, oh. Yeah, yeah, those are some trusting people. That's not not a great idea. Yolo mode plus API keys equals some other kind of mode that is not just Yolo anymore. Yeah, beyond Yolo upside down Yolo. Nice, the stranger Yolo. All right, cool. Yeah, we're about at time here. Yeah, thanks Will for coming on. Thanks everyone for listening. If you liked it, please subscribe.

45:06Leave us some reviews. We appreciate it and we will catch you next time. What the fuck are you talking about, Chuck?