Whiskey Web and Whatnot

The authoritative voice of AI, programming, and the modern web. Also whiskey.

227: MCP Security, Framework Fatigue, and AI Agents with Will Johnson (Presented by CodeRabbit)

This week, Robbie and Adam talk with Will Johnson—senior developer advocate at Auth0—about web dev, parenting, and internet culture. They debate whether CSS is a “real” programming language, riff on how modern frameworks can feel over-engineered, and dig into ...

Creators and Guests

RobbieTheWagner
Adam Argyle
Will Johnson

Sponsors

Show Notes

This week, Robbie and Adam talk with Will Johnson—senior developer advocate at Auth0—about web dev, parenting, and internet culture. They debate whether CSS is a “real” programming language, riff on how modern frameworks can feel over-engineered, and dig into the security risks emerging around AI agents and MCP. Will shares what he’s been learning about MCP security, why he’s cautious with new tools, and how Auth0’s new AI agent offering helps manage identity, permissions, and token safety.

Presented by CodeRabbit: http://coderabbit.link/whiskey

In this episode:

  • (00:00) - Intro

  • (01:49) - Meet Will Johnson

  • (02:19) - Whiskey rating & review: Jameson Triple Triple

  • (07:13) - Hot Take: Git rebase vs git merge

  • (09:42) - Parenting talk: kids, wrestling, and learning consequences

  • (11:57) - Hot Take: Is CSS a programming language?

  • (14:37) - What Will’s working on at Auth0 (AI + MCP security)

  • (16:57) - The most interesting MCP-related hacks and security risks

  • (18:27) - Can “skills” become an attack vector too?

  • (19:47) - Security vulnerabilities, Next.js updates, and patching fatigue

  • (20:48) - How Will’s family got into K-Pop Demon Hunters

  • (25:51) - The Moana live-action trailer “looks like useEffect” (and why)

  • (27:17) - Is React essentially processed American food?

  • (27:58) - Sugar-free Oreos: what are we even doing here?

  • (29:18) - Have we overcomplicated frontend development?

  • (31:32) - Why Rails is the best-engineered dev experience Will has used

  • (32:25) - How Auth0 teams are structured

  • (35:47) - Passkeys explained

  • (41:43) - Plugs and how to connect with Will

  • (43:12) - How AI agents fit into auth

Links

Connect with Will

Connect with the hosts

Subscribe and stay in touch

Whiskey Web and Whatnot Merch
Enjoying the podcast and want us to make more? Help support us by picking up some of our fresh merch at https://whiskey.fund.

Episode Transcript

[00:00:00] Intro: Welcome to Syntax. Welcome to a brand new episode of the Front End Happy Hour podcast. Welcome to this week’s JS Party. Live from Ship Shape Studios, this is Whiskey Web and Whatnot. With your hosts, Robbie the Wagner, and me, Charles William Carpenter III. That’s right Charles. We drink whiskey and talk about web development.

[00:00:27] Intro: I mean, it’s all in the name. It’s not that deep. This is Whiskey Web and Whatnot. Do not adjust your set.

[00:00:36] Robbie Wagner: Whiskey web and whatnot is brought to you by.

[00:00:41] Adam Argyle: Code reviews are critical, but time consuming code Rabbit acts as your AI co-pilot providing instant code review comments and potential impacts of every pull request beyond just flagging issues. CodeRabbit provides one click fix suggestions and lets you define custom code quality rules. Using AST grep patterns, this catches subtle issues that [00:01:00] traditional static analysis tools might miss.

[00:01:02] Adam Argyle: CodeRabbit is the category defining platform for AI code reviews. Built for modern engineering teams navigating the rise of AI generated development code Rapids context aware reviews, pulling dozens of points of context, making them the most comprehensive AI code reviews with customization features that allow you to tailor your review to your code base.

[00:01:20] Adam Argyle: Code Rapids comments and proof with time and interactions. CodeRabbit helps organizations catch bugs, strengthen security, and ship reliable code at Speed Trust by thousands of companies in open source projects worldwide. CodeRabbit helps reduce review time and bugs by 50%.

[00:01:36] Robbie Wagner: Hey, what’s up everybody? This is Whiskey Web and Whatnot. With your hosts, RobbieTheWagner, and Adam Thomas Argyle, The Nerd.

[00:01:45] Adam Argyle: I am here, y’all. What’s up?

[00:01:48] Robbie Wagner: We are all here.

[00:01:49] Robbie Wagner: We have a guest here. Would you like to tell the folks who we have here, Adam?

[00:01:53] Adam Argyle: Oh yes, I would. Today we have senior developer advocate at auth, zero, egghead [00:02:00] instructor of so many lessons. The site had to show pagination, K-pop, demon hunter’s, karaoke track, ripper rad, dad and killer web developer. Welcome Will Johnson.

[00:02:10] Will Johnson: Hey

[00:02:11] Will Johnson: everybody. Thanks for

[00:02:12] Will Johnson: having me.

[00:02:14] Adam Argyle: thanks for coming on the show. Appreciate it.

[00:02:17] Will Johnson: Yeah, no problem. I’m glad, glad to be here.

[00:02:19] Will Johnson: I got my, I got my, my Jameson,

[00:02:23] Will Johnson: my.

[00:02:24] Robbie Wagner: Nice. Nice.

[00:02:26] Adam Argyle: The triple, triple, triple, triple, triple, Hey, three. Three people on the show with three triple triples. it’s time to crack it open.

[00:02:33] Adam Argyle: Let’s

[00:02:33] Robbie Wagner: All right. Yeah, they get that pop. kind of surprised this is twist. Does Jameson usually twist?

[00:02:40] Adam Argyle: I.

[00:02:42] Robbie Wagner: Maybe they’re just precise like that. So yeah, this is the triple. Triple. It is called that because it is triple distilled in triple casks of bourbon, sherry and chestnut casks. It is something proof, 80 proof. and it is 80% corn and 20% malted barley from what [00:03:00] I hear. And four years old, I believe.

[00:03:02] Adam Argyle: They should have gone with three then it’s a triple, triple

[00:03:05] Adam Argyle: for three.

[00:03:05] Robbie Wagner: I see.

[00:03:06] Will Johnson: Yeah, to keep the triple going.

[00:03:08] Adam Argyle: Yep, three. Three’s

[00:03:09] Robbie Wagner: Or nine if you’re triple, triple three times

[00:03:12] Adam Argyle: Triple. Yeah. Nice.

[00:03:14] Adam Argyle: Wait three times. Three times three though. That’s the really expensive one. The 27 years

[00:03:19] Robbie Wagner: Ooh, this tastes different than I thought it would. Wow. That’s got a lot going on.

[00:03:23] Adam Argyle: it does no bite. Lots of sweet.

[00:03:26] Adam Argyle: Mm-hmm.

[00:03:27] Adam Argyle: Mm-hmm.

[00:03:27] Will Johnson: very true. No bite.

[00:03:29] Robbie Wagner: Yeah. Not a ton of alcohol. Definitely a lot of different woods. little sweetness from the sherry. I think, I don’t know. I’m having a hard time picking out particular notes.

[00:03:37] Adam Argyle: Hmm. I’ve been really enjoying smelling an empty glass. ‘cause then I feel like I get this more true, true scent of what? What’s in there? I don’t know.

[00:03:47] Adam Argyle: This is good

[00:03:47] Robbie Wagner: says we’ll influence ourselves. Here it says toffee, cacao, and toasted almond.

[00:03:52] Adam Argyle: Hmm.

[00:03:53] Robbie Wagner: there is, okay. That that’s on the outside. There’s a spider crawling on the outside of mine and I was like, are you on the inside? How are you alive?[00:04:00]

[00:04:02] Adam Argyle: It’s like that tequila that has, uh, snakes and scorpions inside. Have you seen those ones?

[00:04:07] Robbie Wagner: Yeah,

[00:04:08] Robbie Wagner: Yeah. Those are

[00:04:08] Robbie Wagner: nuts.

[00:04:09] Adam Argyle: That’s

[00:04:09] Adam Argyle: nuts.

[00:04:10] Will Johnson: they was in like a lot of nineties movies. I, I thought I would experience that like a lot more than I did. But no, I, I haven’t seen one in person, but they was always in nineties movies.

[00:04:20] Adam Argyle: I haven’t seen one in person either. I saw it in that TV show. Three Sheets to the Wind. Do you know, do y’all know that show?

[00:04:27] Robbie Wagner: Mm.

[00:04:28] Adam Argyle: It was this guy. It’s actually very apropos for this, uh, this show. This guy went around it and drank beer around the world. Actually. It wasn’t just beer. He just got hammered everywhere around the world.

[00:04:37] Adam Argyle: And so he would find the local. And he’d be

[00:04:40] Robbie Wagner: Was it

[00:04:40] Adam Argyle: what are, what are you drinking? It should have, , but yeah, three sheets is a reference to getting super drunk. And so he’d go to all these places, get hammered with the locals, drinking whatever they drink locally. whether it was like a local rum was the thing that they were known for, or if it was a whiskey that they were known for or a beer.

[00:04:56] Adam Argyle: and so then the next morning he would then have the local hangover [00:05:00] remedy. So that was the whole episode was you see him basically going from bar to bar and distillery to distillery. Learning the history about why this place has this particular booze in this area, drinks a lot of the booze. never really like, stumbles around and gets, you know, ridiculous whatever, and then wakes up and uh, but in one of those episodes, okay, sorry to bring it full circle, he drinks some of the rums, , that have snakes and stuff in ‘em.

[00:05:23] Adam Argyle: And that just looked so gross. I was like, there’s like a dead body in that thing. You’re just gonna pour it out and drink from the dead body juice. I’m like, that’s death juice. Okay, that’s fine.

[00:05:32] Robbie Wagner: Yeah.

[00:05:33] Adam Argyle: It was a good show.

[00:05:34] Will Johnson: Yeah. I mean it sounds interest, especially the Heart Andover Cure part.

[00:05:37] Adam Argyle: Yeah. Very funny remedies. Yep.

[00:05:42] Robbie Wagner: Sorry. I was gonna say, we have a rating system for whiskey on this show. We’ll do it real quick before we forget. Zero to eight tentacles, zero being the worst. Throw it out. Wouldn’t clean your toilet with it. Eight being the best. Clear the shelves drinking nothing else. Four or five-ish.

[00:05:55] Robbie Wagner: Middle of the road. What do you think, Adam?

[00:05:58] Adam Argyle: I am liking it. I’m also tasting a [00:06:00] little bit more, more caramel as we go in.

[00:06:02] Adam Argyle: I also kind of feel like I tend to get a lot of caramel, but it’s just from that like sweetness, a little sticky. It’s good. This one is better than the Jack Daniels Reserve from last week, which I gave quite a poor rating. , I’m gonna put this one like a five and a half.

[00:06:14] Adam Argyle: . I’m not sad. It’s, yeah, the, the lack of bite is kind of, is good. it’s got a nice smoothness to it, which is nice. cool. So anyway, you have five and a half outta me.

[00:06:22] Robbie Wagner: Nice. Nice. Will, what do you think?

[00:06:24] Will Johnson: Well, honestly, this is my first whiskey ever.

[00:06:28] Adam Argyle: outta here.

[00:06:28] Robbie Wagner: What? fact that it, yeah, it is. So the fact that it didn’t burn, you know, like I can actually like just drink it and, you know, kind of chill. I like that. , So I’m gonna give it a, a seven.

[00:06:42] Robbie Wagner: nice.

[00:06:43] Will Johnson: The, bar is

[00:06:43] Will Johnson: high,

[00:06:44] Robbie Wagner: I don’t know if we’ve had a, a lot of Irish ones on the show. I think this one is a lot more interesting than a couple of Irish ones I’ve had. , I’m gonna say, yeah, we’ll give it a six. Pretty solid.

[00:06:54] Will Johnson: plus my son named Miss Jameson,

[00:06:56] Will Johnson: so

[00:06:57] Adam Argyle: I was just gonna say, you gotta tell the story of why [00:07:00] we picked this one for you. This is not an accident. also, well, I guess you just let the cat outta the bag there though, so that you know, can’t, can’t create any suspense. yes. It’s your kid’s name.

[00:07:08] Adam Argyle: Nice. That’s okay.

[00:07:13] Robbie Wagner: All right, so we have some lukewarm takes that we usually do on the show. , We’ll start with a fan favorite, get rebase or get Merge.

[00:07:24] Will Johnson: I know rebates get a lot of heat, but let’s go, let’s go rebates.

[00:07:30] Robbie Wagner: Nice.

[00:07:30] Adam Argyle: think you’re in a rebase friendship zone right

[00:07:33] Adam Argyle: here,

[00:07:33] Adam Argyle: so.

[00:07:35] Will Johnson: Okay,

[00:07:36] Adam Argyle: I, I used to merge, but you know, now I rebase. Although at work it’s called a, a sack. It’s really annoying when you kind of go into these other environments that have Git workflows, but they wanna rename everything. man, it’s annoying. It was at Chrome two when you’re working on Chrome, you, didn’t really get normal commands, like everything was abstracted in some way.

[00:07:55] Adam Argyle: Shopify we don’t Rebase. No one even says Rebase. They stack, we [00:08:00] ack, or I’m gonna stack off your stacker anyway. I don’t, I don’t mind the word stack. It’s kind of nice, but still I’m like, Hey, Rease is the way.

[00:08:07] Robbie Wagner: Yeah. It at least makes a little sense. It’s not like, yo, I’m on a pizza. Like what?

[00:08:14] Adam Argyle: Oh no, we lost a will

[00:08:18] Robbie Wagner: he didn’t like my

[00:08:18] Robbie Wagner: joke.

[00:08:20] Adam Argyle: just gotta hang in there. He was losing connection a little bit, so maybe, uh, it got disconnected or he did what I

[00:08:25] Robbie Wagner: is sponsored by Verizon Fios.

[00:08:31] Adam Argyle: Sponsored by the sweet light fixture that I need behind me to illuminate all my stuff, man. Yours are cool. Do you have new, you’ve got like a,

[00:08:39] Robbie Wagner: I changed the

[00:08:40] Adam Argyle: back there now. Ah, nice.

[00:08:41] Robbie Wagner: Yeah. No, I’m standing up so you can see my shelf. Usually you can’t.

[00:08:45] Adam Argyle: Sick. Looks good.

[00:08:46] Robbie Wagner: you can almost see the Ember sign. It’s right. Uh, right there it says Ember.

[00:08:55] Adam Argyle: That

[00:08:55] Robbie Wagner: No one will ever

[00:08:56] Adam Argyle: blurry. Camera’s too good. Can’t, can’t read it.

[00:08:59] Adam Argyle: [00:09:00] live on Twitch just to you and I together,

[00:09:03] Robbie Wagner: I don’t know what to do with my hands. Like, uh,

[00:09:07] Adam Argyle: dude. Do you ever do the dad hand hip thing? I hate it. I do it all the time. I’m like, oh, my hands are on my hips. There’s gotta be a cooler place to put my hands and it’s not on my hips. And so I, I put ‘em in my like jacket pocket. I’m like, yeah, I’m still cool. I’m still young. I’m not a dad. I don’t

[00:09:22] Adam Argyle: put

[00:09:22] Robbie Wagner: You mean like, like the scolding pose, like

[00:09:25] Adam Argyle: Yeah, man.

[00:09:26] Robbie Wagner: that.

[00:09:28] Adam Argyle: Yeah, just kind of, yeah. I’ll just walk and be like, what do you think you’re doing? I’m like, oh crap, I’m doing the thing. I got my

[00:09:32] Adam Argyle: hands on my hips. It’s ridiculous.

[00:09:34] Robbie Wagner: Yeah, I, I don’t find myself doing that. , Yeah, I, I usually go pockets, depends on what I’m wearing, I guess. But haven’t had that issue.

[00:09:41] Adam Argyle: Pockets is good.

[00:09:42] Adam Argyle: A man had a fun, parenting thing the other day where like, they’ve been wrestling a lot more, right? I have like two boys, right? So they’re like wrestling a bunch and usually someone cries and then they go, oh, we got a wheel back. Anyway, my kids were

[00:09:54] Robbie Wagner: That’s a weird thing for your kids to

[00:09:56] Adam Argyle: Yeah. I got a will back.

[00:09:59] Adam Argyle: Yeah. [00:10:00] Uh, they were beating each other up though. And um, they didn’t want to get in trouble though. They’d been getting in trouble a lot for like hurting each other. So like, now they hurt each other and they suck it up.

[00:10:09] Adam Argyle: And I

[00:10:09] Robbie Wagner: Oh,

[00:10:10] Adam Argyle: that’s good though. I was like, yes. Become stronger. My children wrestle and suck it up.

[00:10:15] Adam Argyle: Yes.

[00:10:16] Adam Argyle: so yeah, mom’s outta town so there’s no one to cry to. ‘cause dad usually goes, oh, you hurt yourselves wrestling. I was like, that’s what you, that’s what you do. I’m like, I’m not here for that.

[00:10:25] Adam Argyle: Like, anyway.

[00:10:27] Will Johnson: Yeah, it is kind

[00:10:28] Will Johnson: of funny like seeing things from the parent perspective. ‘cause it’s like I’ve been through this a hundred times and I know it’s not that bad, but this is like. Your first time and it’s so serious and I gotta be like, yeah, , this is what happens when you wrestle. When you jump down six stairs, , your legs going to hurt like this.

[00:10:45] Will Johnson: This is the process.

[00:10:47] Robbie Wagner: Yeah. I feel like it’s, it’s tough ‘cause a lot of parents, you’re on one side or the other. Usually it’s like, don’t police it at all. Just let them get super hurt and they’ll learn. Or like you’re trying to keep them from getting hurt, like [00:11:00] from everything. And I don’t know, there’s not really a happy medium.

[00:11:03] Robbie Wagner: ‘cause if you protect them sometimes, then they don’t understand what getting hurt is. I mean like our son is like, oh, a knife. Like, let me just grab that by the sharp part. And I’m like, why don’t do that? Please. Like I just told you not to do that.

[00:11:19] Will Johnson: Yeah, you

[00:11:19] Adam Argyle: Can’t remember Will, how old is your kid or your kids? Do you have one or two? I can’t remember.

[00:11:24] Will Johnson: my oldest is, oh, you are way off. I have six, so my oldest is

[00:11:30] Adam Argyle: I am off.

[00:11:31] Will Johnson: is eight

[00:11:33] Adam Argyle: Dang.

[00:11:34] Robbie Wagner: Yeah. You’re in

[00:11:35] Adam Argyle: You need to teach us stuff. Okay. So yeah, I’m seven and nine and his are like all under four. Right.

[00:11:41] Robbie Wagner: Yeah. Finn is three and the twins are seven months today.

[00:11:44] Will Johnson: twins. Cool. I, I, we wanted twins. Didn’t happen, but.

[00:11:49] Robbie Wagner: Yeah. It’s uh, I mean, it’s fun, but it’s also a lot like they’re never calm at the same time, so.

[00:11:57] Adam Argyle: All right. Should we jump into more takes? [00:12:00] What do you think?

[00:12:00] Robbie Wagner: dealer’s choice. Adam, you got one you wanna do?

[00:12:03] Adam Argyle: Yeah. Well, I mean I’m this, I’m partial to this one. I was reading an article the other day where someone said what I wanted them to, so Will, this is a question for you to say What I want you to or to say what you want

[00:12:13] Adam Argyle: you get to

[00:12:14] Adam Argyle: choose is CSS a programming language.

[00:12:17] Will Johnson: Oh man, that’s a great question. Now, is it a programming language? It depends on, I guess it depends on how you’re using it. Because there are some things that you can programmatically and mathematically do with CSS, but you know, if you’re just, you know, making a button round, I don’t know. But if you’re like making it change to how wide the page is and stuff like that, I feel like you are doing some programming there.

[00:12:45] Will Johnson: So I guess it depends on what you’re doing.

[00:12:46] Adam Argyle: That answer rocked my face, man, that was, I think that might be one of the best answers. ‘cause, ‘cause yeah, you’re right. If, if you’re just changing the color to red and you know, everyone feels successful, you’re not necessarily a programmer, but you did write some code, I [00:13:00] suppose. , But if you’re like, legit, you’re writing loops and you’re, you’re filtering over stuff and you’re doing something very programmatic, you’re using trig functions.

[00:13:08] Adam Argyle: Well then you’re definitely, so this, the per, the article I read was a hacker. The hacker was like, Hey, look at what I can do with css. CSS is one of the next best things that you can use, then JavaScript to do your hacking. And they came up with this new hacking exploit using CSS and all this kind of interesting stuff.

[00:13:25] Adam Argyle: And they were quoted in the article as saying CSS is a program language. Like, look at, look at what you can do. but I

[00:13:31] Robbie Wagner: Maybe that should be the measurement. If you can, exploit something and get into a system with it. It has

[00:13:37] Robbie Wagner: to be a programming

[00:13:38] Robbie Wagner: language.

[00:13:38] Will Johnson: Yeah, because that’s pretty deep to do that with CSS.

[00:13:43] Robbie Wagner: Yeah. Yeah. I would not have thought of that. today my wife was looking at, um, architectural Digest to look at a color of a wall. Like there was a picture she had seen, and we load the page. All the pictures and like texts come in for like a second and then go away. ‘cause it’s like you gotta pay for [00:14:00] this.

[00:14:00] Robbie Wagner: And I’m like, wait. So they’re there and you remove them now? Like you guys used to throw a like thing up over it. I could delete it. I was trying to find my way around all the stuff. But they like programmatically delete all the chunks of the page. They got like 25 little JavaScript scripts that like delete everything.

[00:14:16] Robbie Wagner: And I’m like, holy shit. Like this is cemented stuff guys. Bravo.

[00:14:22] Adam Argyle: Yeah, that’s like those read more buttons where it’s like click the read more and then it just expands. I’m like, I’m gonna do that myself. , But you’re right. If they are. deleting or it’s not even there. It’s a totally different story.

[00:14:34] Robbie Wagner: Mm-hmm.

[00:14:36] Robbie Wagner: Yeah, I was impressed.

[00:14:37] Adam Argyle: What are you doing at, uh, AU zero right now, dude.

[00:14:39] Adam Argyle: And how long you been there?

[00:14:41] Will Johnson: I’ve been at oh zero for like four and a half years. I think I hit four back in August, so yeah, I don’t know. Four and 12, five. It’s like almost four and a half years then.

[00:14:51] Will Johnson: been a good ride. You know, especially now, I think I’m having, , the most fun just because of, you know, the changes, you know, with AI [00:15:00] becoming like more prevalent and, you know, finding a ways to like, you know, secure ai, and tools that we use.

[00:15:07] Will Johnson: Like one of the, probably the, what I’ve been into lately is like MCP security. ‘cause MCP, you know, just had its year birthday. , And there’s been like a lot of changes with MCP and like how they. Do security and they’re like, you know, still trying to figure it out. So it’s been kind of cool, like watching like that whole you know, process of like, okay, we’re going to do this.

[00:15:28] Will Johnson: I don’t think that’s right. Let’s, you know, try to do something different. Like, like one thing is like a big thing for like a few months was like dynamic client registration, letting the Mt p servers like register on their own. Then they was like. Hold on, that’s like way too free. And then every time you know, someone registers, you know, it creates like a different instance even though it might be the same person.

[00:15:52] Will Johnson: So now they got like two different identities or 50, like however many they end up using. So like just recently the spec introduced something called [00:16:00] CIMD, which is Client ID metadata documents. And it’s basically like a URL where you kind of like host your identity for your MCP server and then it like validates.

[00:16:10] Will Johnson: If it actually belongs to this user. So it kind of like made it more secure and then it didn’t make a new one every single time you tried to like register, a MCP client. So that’s lately what I’ve been into, just checking out the MCP security stuff.

[00:16:24] Robbie Wagner: Nice. Yeah, I think that is a, there’s a lot of security things that are going to come to light with AI that, , people are just like, oh, it’s a, it’s a paradise. We can just, you know, get all this stuff for free and everyone can do everything. And. Um, yeah, that’s bad when everyone can do everything. Actually, there’s a lot of security vulnerabilities to that.

[00:16:43] Adam Argyle: It seems like you could charge a lot of money through an MCP server too. So you gotta, that’s why you gotta protect ‘em. So a lot of people have tokens that you have to, so you go buy your token to give you even access to the MCP. So I, I’m sure a bunch of people are like, oh, uh, I’m gonna get around your token.

[00:16:57] Adam Argyle: What are some of your favorite hacks that you’ve seen? Are there any [00:17:00] funny ones where you’re like. You know, that have like a silly name like the midget on your back hack, and it just is like, it’s like a little midget AI that’s on the, I don’t know, I’m making, I’m making that up, but I’m like, are there any funny hacks that have happened to MCP servers or, yeah.

[00:17:12] Adam Argyle: What’s

[00:17:13] Adam Argyle: up?

[00:17:13] Will Johnson: I mean, not that I’ve seen, I haven’t seen any funny ones, but I, I definitely seen some ones that made me. Like second guess, like every, like, new tool that comes out. So I’m not gonna name any names, but there are like lots of, exploits where you’ll like download, A CLI and it’ll somehow they find, they even bypass the chat that there’s like a, like there’s something like a, you know, malware or something in it.

[00:17:37] Will Johnson: , It kind of like approves itself. , And then it’ll. It’ll like run another program through your, like, AI agent in the CLI and you literally won’t have any idea because it deletes its history of like, what it does and stuff like that. So I’ve seen some pretty intense ones.

[00:17:53] Will Johnson: you know, that, that cause a lot of like hiccups. So now, when something new comes out, I’m definitely not the, I’m not the first person to [00:18:00] jump on it. Not, not, not even on like a personal machine, like I’m waiting.

[00:18:05] Robbie Wagner: Yeah. Yeah, that’s fair. I mean, that’s, anytime there’s new stuff, I feel like everyone comes out of the woodwork to do that kind of thing. Like NFTs had that problem, like, oh yeah, a contract. Let me sign that. Oops. Like, yeah, so I think like, you know, people are waiting for the new thing to have a little bit of hype and then like steal as much stuff as they can as fast as they can and get outta

[00:18:25] Robbie Wagner: there.

[00:18:26] Will Johnson: Yeah, exactly.

[00:18:27] Adam Argyle: So, I’ve heard through the grapevine that MCP had its year, and that might be its limited set of 15 minutes of fame that it had, because skills are where it’s at. Can skills also hack someone? Have you found any exploits through that mechanism?

[00:18:44] Will Johnson: so far I haven’t, , found. Or heard of any at least. And like I do look in quite a different, like communities and, and for like, you know, like cybersecurity and stuff like that, just to see what they’re talking about. So far I haven’t seen any. So, but you never [00:19:00] know what might happen as they like gain populars.

[00:19:02] Will Johnson: I think skills are like fairly new, like a month or two old, MCP is not necessarily old, but it’s a year old and it’s getting more hype, so. More people are, you know, it’s becoming like an attack vector because more and more people are talking about it. More people are releasing servers. So if the thing, same thing happened with skills, then, you know, I might, you know, start to see more traffic.

[00:19:23] Will Johnson: But as of right now, I haven’t, I haven’t seen any, anything going on with that.

[00:19:26] Adam Argyle: Yeah. Cool. Yeah, the only hack I saw was that if you dynamically create your skills, the skill that you created could be full of stuff that you didn’t intend. And so then every time you use this skill, it’s coming with all this context or all this personal information that you didn’t think it would. And I don’t know submitting it somewhere, but Interesting.

[00:19:45] Adam Argyle: So you’re following all the MCP hacks, ,

[00:19:47] Adam Argyle: since you see the next Js , news that came out, is everybody freaking out to update their builds?

[00:19:52] Will Johnson: Yeah. Yeah, I did see that. I did see that. Yeah. Actually wrote a, well, I, no, that was a different blog post, but I, I wrote a blog [00:20:00] post about the next day. Yes. Updates from like, a couple months ago. But yeah, I did see the, , the vulnerability that they had and, just make sure you update your packages, people.

[00:20:12] Adam Argyle: Or

[00:20:12] Robbie Wagner: Yeah, there’s a lot of that going around.

[00:20:14] Adam Argyle: I don’t know which one’s better to update

[00:20:16] Adam Argyle: constantly or to

[00:20:17] Adam Argyle: not

[00:20:18] Will Johnson: Yeah, exactly. Well, I think in, in this case, you might want to update, but Yeah, I get, I get what you’re saying. ‘cause then you’ll update and then something else goes wrong.

[00:20:27] Robbie Wagner: Yeah, always be updating. That’s what I do. does PMPM update every time you , pull down the code. Just update everything. That’s fine.

[00:20:34] Adam Argyle: That’s what they want you to do, Robbie. They want you to keep updating.

[00:20:38] Robbie Wagner: Twitter will tell me if there’s a problem. It’s okay.

[00:20:40] Will Johnson: updates. Yes, Twitter will tell you it’s a problem several times.

[00:20:48] Robbie Wagner: Yeah.

[00:20:48] Adam Argyle: So if your kids are that old, how is K-Pop demon hunters so popular in your house? Are you the main driver of that?

[00:20:54] Will Johnson: No, I think it is all of us. I mean, the youngest is eight and then we got teenagers. So I wouldn’t say [00:21:00] that I’m the,

[00:21:00] Will Johnson: the main driver. I think it’s

[00:21:01] Will Johnson: just

[00:21:01] Will Johnson: like

[00:21:01] Will Johnson: a it’s just a, it is just a whole thing. I think like, you know, the music is good, you know, it’s, it’s funny, it’s goofy. yeah, I, I, I didn’t expect my sons to like it as much as they do, like them walking around, singing soda pop or your idol or anything like that.

[00:21:15] Will Johnson: I didn’t expect that, but. Yeah, I think that is just, I don’t know, it just, it just, for me personally, it hit a lot of like nostalgia notes, You know, two thousands you had like Britney Spears and like N Sync and then like the Boy Vans and like B 2K and Chris Brown and like all of that stuff.

[00:21:31] Will Johnson: So that was like my like era, like my heyday. So even like when just like when they, the Saja boys reformed in the street, I’m like, that’s something somebody would’ve did in like, you know, 2002 or something like, so it just hit a lot of nostalgia beats for me.

[00:21:44] Adam Argyle: It is really good. Robbie, have you seen it yet? K-Pop Demon Hunters.

[00:21:47] Robbie Wagner: I have Caitlyn and I watched it ‘cause we wanted to see if we were gonna let Finn watch it or not. It doesn’t have anything that’s like too bad, but there’s just enough of like, I don’t remember the exact wordage, but like, I’m gonna kill you. Or like, whatever. [00:22:00] We’re like, we don’t want him being like, I’m gonna stab and kill things like they do with like the demons or whatever.

[00:22:04] Robbie Wagner: So like, he already does that and I don’t know where he got that from. Like, we never say that.

[00:22:09] Adam Argyle: Yep. It’s guns. Guns show up. You’re like, I don’t know where you learn about guns, but as soon as they just smell the concept of a gun, they’re like, look at the power. And they just go around imitating it. You’re like, dang it.

[00:22:20] CTA: This just in! Whiskey.fund is now open for all your merch needs. That’s right, Robbie. We’re hearing reports of hats, sweaters, and T-shirts, as well as a link to join our Discord server. What’s a Discord server? Just read the prompter, man. Hit subscribe. Leave us a review on your favorite podcast app and tell your friends about our broadcast. It really does help us reach more people and keeps the show growing. All right, back to your regularly scheduled programming.

[00:22:53] Robbie Wagner: Yeah. But I mean, it’s definitely a great movie. I feel like, , you know, it got so much hype because the music is so good, and I feel [00:23:00] like it was a easy gateway into K-Pop for people who hadn’t listened to anything K-Pop before.

[00:23:05] Robbie Wagner: Because like Caitlyn listens to a good bit of K-pop and like it’s all pretty dang good.

[00:23:10] Robbie Wagner: But like, I think if you hadn’t heard it before, you’re like, oh dang, this is really good.

[00:23:14] Will Johnson: Yeah. Yeah, for

[00:23:15] Will Johnson: sure. I think that it is a good gateway.

[00:23:18] Will Johnson: Yeah, I was initially turned off by

[00:23:20] Will Johnson: like

[00:23:21] Adam Argyle: How did you get turned on? Will

[00:23:25] Will Johnson: no. I was initially turned off by the name like K-Pop Demon Hunters that sound, it just sounds like that’s the cringes thing to ever exist. And then I had like

[00:23:33] Will Johnson: a

[00:23:33] Will Johnson: mental

[00:23:34] Will Johnson: picture. Yeah, completely different of like what it was going to be like.

[00:23:38] Will Johnson: I thought it was gonna be like that. You know how the modern animation is like really bad in comparison to, you know, the cartoons we grew up with or whatever. So I was like, I just had it, it looked really bad in my head. , And then my daughter was like, she watched it and she was like, do you want to watch it?

[00:23:53] Will Johnson: I think she was like, I think you might think it’s cringe. Like she wasn’t even sure if I would like it. But I mean, first five minutes I [00:24:00] was, me and my wife, we were locked in. Like it. It was good. So yeah, and I think that, I think that’s my favorite part about it is that it came out of nowhere. Like it didn’t have a big marketing push.

[00:24:11] Will Johnson: It didn’t have a big height. It showed up on Netflix. You’re like, this is the worst name ever. What is this? And then you click it and it was a quality film and I think that’s why it, like no one told you it was good. You have to figure it out on your own. I think that was like the reason why it got so popular.

[00:24:28] Adam Argyle: Nice. Like a band that you found? Yeah,

[00:24:31] Robbie Wagner: Yeah. It’d be like naming a movie. This movie sucks. And like people would be like, well, does it, I got a C now. Like

[00:24:38] Will Johnson: yeah, exactly. Worst movie ever. I would actually, if I seen no

[00:24:42] Will Johnson: trailer

[00:24:43] Will Johnson: exactly, I would, if I seen nothing about it and I seen that title I would have to click and and check it out.

[00:24:49] Robbie Wagner: yeah, for sure.

[00:24:50] Adam Argyle: I heard the, uh, the person that wrote a lot of the songs and that sang in it, , got kicked out of this music school that they were in. So it’s like, apparently there’s like really competitive [00:25:00] K-pop music schools and this person got kicked out for whatever reason, for not performing well or not doing well.

[00:25:08] Adam Argyle: Apparently it sent them into this state of, Payback or whatever, and they just wrote all these songs performed and kicked a bunch of ass, and all of a sudden now they’re just probably like in your face. They’re just going around. It’s like, you kicked me out and now I have a trophy. You know, like, what are you?

[00:25:25] Adam Argyle: You were wrong and you were wrong, and you were wrong.

[00:25:30] Will Johnson: Yes. Spike dip, spike driven song development. I like it.

[00:25:35] Robbie Wagner: Yeah.

[00:25:35] Adam Argyle: It kind of works. I got told that I wasn’t gonna go to Stanford in high school, and I was like, screw you, man. I’m totally gonna go. And I didn’t go, but whatever. I, I, I tried for like a year just to piss that guy off. He was right though.

[00:25:47] Robbie Wagner: Yeah, that is how it goes. Just try to do what people say you can’t do.

[00:25:51] Adam Argyle: Robbie, why did you write Moana? Looks like use effect.

[00:25:56] Robbie Wagner: No, I found it on Will’s Twitter. I don’t [00:26:00] remember.

[00:26:00] Adam Argyle: Oh

[00:26:01] Robbie Wagner: like this Moana live action movie looks like use effect or

[00:26:04] Adam Argyle: dude. Tell me more. That’s amazing.

[00:26:08] Will Johnson: okay. Oh, man, that’s funny. So, uh, the lore behind that, , so I don’t know if y’all know, like, on the, it is mainly a sports thing. It’s mainly a sports Twitter thing. So, you know, if a player is bad, they’ll say that they’re ass, right?

[00:26:24] Will Johnson: They like, oh, whatever, whatever is ass, or whatever, whatever. So now when something is bad or as they’ll say, like a song, they’ll be like, oh man, this song is Dak Prescott. Like, so that’s kind of like, how they do it. So I, I, I seen that in the Moana live action looks bad and everybody’s been talking so much trash on use effect.

[00:26:45] Will Johnson: So that’s what my, so I’m saying like use effect is as, so I’m like that this looks like use effect. So that was, I know nobody would knew what it meant, but I just wanted to say it Anyway, so that’s that where that came from.

[00:26:56] Robbie Wagner: Nice.

[00:26:57] Adam Argyle: a great use of Twitter is to say something that’s like, [00:27:00] I don’t think anyone else is gonna know. And you know what? I don’t give a shit. I’m gonna say it anyway. It’s just like vague proclamations. You’re like, no context. Here’s a few words, figure it out. I love it, dude.

[00:27:11] Robbie Wagner: Yeah. Now that I know the explanation, I, I really like that. But, uh, yeah, I did not understand.

[00:27:17] Adam Argyle: It’s like when I came back from, uh, Japan and I was like eating, , fruits and vegetables as they come out of the earth is like using the web platform, eating a meal that had got ground up and bashed up and powdered up and then reformed into a poof. And then you put a bunch of preserves and a bunch of more stuff that you had to shove more stuff into it.

[00:27:37] Adam Argyle: And then you had this basically mishmash thing that you eat. That’s React. And I was like, Americans eat, like react in Japan. They eat like the web platform. And your, your statement there reminds me a lot of that where you’re like, I’m gonna extrapolate this weird thing into this completely other unrelated weird thing

[00:27:54] Will Johnson: Yeah.

[00:27:55] Adam Argyle: because my brain is weird and I’m gonna share it.

[00:27:57] Adam Argyle: It’s awesome.

[00:27:58] Robbie Wagner: Speaking of, uh, you know, [00:28:00] mashed up preservatives, I saw your tweet about sugar free Oreo or your retweet of their, uh, ingredients or whatever.

[00:28:09] Robbie Wagner: yeah. How do you feel about that?

[00:28:10] Will Johnson: Just gimme the sugar, man. What, what did I gotta see? What did I respond? Because I know I said

[00:28:17] Robbie Wagner: some emojis.

[00:28:18] Will Johnson: Oh, okay. Yeah, yeah. ‘cause it’s like we’re removing the sugar. Like first of all I don’t have the tweet up ‘cause my computer’s going really slow. I mean, I can look on my phone, but two of the ingredients ending like a sugar word, like dextro and whatever, whatever. So like, bro, it’s still sugar. Yeah. It was like sucralose, poly dextro. That’s still sugar. Like it’s not table sugar, but it’s still sugar. and then just gimme the sugar like

[00:28:48] Robbie Wagner: Yeah.

[00:28:49] Will Johnson: Malitol poly Dextro, sucralose and Ace. K have her place sugar, bro. Just gimme the sugar, man. Like we’re like.

[00:28:59] Adam Argyle: Okay, so [00:29:00] you’re saying Oreos are a React component? That’s what I’m hearing right now.

[00:29:02] Adam Argyle: ‘cause

[00:29:03] Adam Argyle: it’s, it’s not really food, it’s just all the weird stuff. It turned into something that I’m gonna give you to eat. But

[00:29:10] Adam Argyle: I love

[00:29:10] Will Johnson: Yeah,

[00:29:11] Will Johnson: exactly.

[00:29:12] Robbie Wagner: a component. Did Mount, I don’t need hooks.

[00:29:18] Will Johnson: I mean, I know, I remember I said something similar to that. Like, no, it was like a, I was talking about, on a Twitter space, and I was like, dude, I was like, just gimme jQuery back, and like the whole like, chat went silent, but.

[00:29:34] Will Johnson: I felt like it was, it was more like straightforward to use.

[00:29:39] Adam Argyle: It sure

[00:29:40] Robbie Wagner: Yeah. Mm-hmm.

[00:29:41] Robbie Wagner: Yeah,

[00:29:41] Adam Argyle: my own modern version called Bling Bling. Oh, go ahead Robbie.

[00:29:46] Robbie Wagner: nice. Yeah. I, uh, I used to use Ken Wheeler’s cash. I thought that was pretty good.

[00:29:51] Adam Argyle: Okay. That’s why I had bling bling. So there was cash, there was bling js and then I had bling bling js. ‘cause I went all ES six and I had this really tight, it was like [00:30:00] nine lines of JavaScript that recreated like the core parts of jQuery. I thought I was so cool. and it was fine. Yeah. yeah.

[00:30:09] Will Johnson: you should resurrect it, man. It can be the, uh, the next K-pop demon

[00:30:13] Will Johnson: hunters in the, in the

[00:30:14] Adam Argyle: still alive. Blank

[00:30:16] Adam Argyle: blink js.

[00:30:17] Robbie Wagner: Yeah, I mean, I feel like, we went too far in like the way front end works now. Sometimes there’s a use case for really intense frameworks, but like the astro model of it’s all vanilla, JavaScript, CSS HTML and then when you need complex stuff, you have maybe one, one little component.

[00:30:36] Robbie Wagner: That has like, some of that in it, but now we’re just like, oh yeah, I gotta like, have a router or a route. And it’s like, oh, that’s, definitely a component. Like actually it’s not a component because it’s uh, it’s a router. so it’s like, I don’t know, trying to fit everything into components and being like, it all has to be like, oh, it can also render on the server or the client or both, or who knows where you are, [00:31:00] is like, maybe we like, maybe we went too far.

[00:31:03] Will Johnson: Yeah, it is like, you know, you wanna, you know, you want to cover, I think that really comes with just like covering as many use cases as possible. because you know, it’s gonna be a wide range of people using the product. So like it, you know, or the framework or whatever. So like, it makes sense, but then, people see that and think that that’s how they should, you know, do it from the jump.

[00:31:23] Will Johnson: You know what I mean? And then. It continues to, you know, over-engineered and over-engineered, and you’re adding this, and you’re adding that when you didn’t really need all of that.

[00:31:32] Adam Argyle: What’s the best engineered thing you’ve ever seen or used where you were like, this is just the right amount,

[00:31:37] Will Johnson: Oh man, Auth0 Well, what a great answer. I can’t you said that.

[00:31:46] Will Johnson: For me though, it was, it was Rails, man. I remember when I used Rails, I like legitimately I was like, dude, I can start a business with this. Like, it was so cool. It was like so easy to understand. And Laravel’s kind of the same, like, I haven’t used [00:32:00] it a lot, but I’ve dabbled in Laravel and it kind of has like the same experience, but Rails I thought was, I used that when I worked at Egghead and I thought that was like for me personally, a great developer experience.

[00:32:11] Will Johnson: I could. Grok anything about it that I need to, in a fairly short amount of time and I could look at other people’s code bases and kind of know what to do and where to go. So I really, I really enjoyed, , the rails experience.

[00:32:25] Adam Argyle: Do you have to manage any of the, , integrations for Oser own? Like sometimes Dere have to do either bug fixes or patches or releases or something like that, or are you involved very much in the interfaces that go into these frameworks or you’re,

[00:32:37] Will Johnson: No, not on, not on our team. So like, we’re separated into like different, ways of Devereux. ‘cause you know, we’re a big enough org. so like, I’m specifically, content, you know, videos, podcasts, blogs, stuff like that. We have a team that’s community focused where they go out and do events and they throw events and, and stuff like that.

[00:32:57] Will Johnson: And then we have like another, that does like that [00:33:00] stuff like. Works on the SDKs and sometimes we’ll help out and help out with docs and stuff like that. But yeah, in my particular role, yeah, I don’t, I don’t work on the SDKs or anything. Main thing I do is like, give

[00:33:10] Will Johnson: the feedback back when I’m

[00:33:12] Will Johnson: out,

[00:33:12] Will Johnson: when

[00:33:12] Will Johnson: I’m, ‘cause people are, you know, in my inbox, you know, or like, Hey, this isn’t working.

[00:33:17] Will Johnson: Or, and honestly it is been some pretty cool stuff coming in my inbox. Like, things not working that we didn’t even like know about. so it is been kind of cool to be out there like that. And. You know, be able to hear from the community and fix things. ‘cause you know, they’re hacking on stuff and, and trying stuff.

[00:33:32] Will Johnson: And so I get to, you know, see like, what are people doing? How are they making this work? And it’d be like, well, it shouldn’t work like that. let me see why are you having to make this hack? Or, you know, why are you running into this? Because it shouldn’t work that way. So that’s been kind of cool.

[00:33:47] Will Johnson: We’ve, we’ve fixed a lot of things just from people being in my dms. Either complaining or just showing me stuff. And they didn’t even know that it was a hack. , They were just doing it and I’m like, oh, that shouldn’t happen. Let’s get that fixed.

[00:33:59] Robbie Wagner: Yeah, you [00:34:00] don’t want hacks in your authentication if you want ‘em anywhere. That’s, uh, not the place.

[00:34:06] Will Johnson: Yeah, E, exactly, exactly. So I, I’m glad that I get to be available out there like that though, so that people can feel like, you know, they got someone they can. Talk to when they’re having, having an issue. So that, that’s like one thing I do enjoy about the dead real role.

[00:34:21] Adam Argyle: You’ve been there long enough, what’s your like, really tight pitch that you have when you’re like, oh yeah, I can pitch au zero, one or two sentences and make it sound good.

[00:34:28] Robbie Wagner: Make it, make it about 60 seconds and then tell us where to send the invoice to.

[00:34:38] Will Johnson: I mean, I can, I can tell you where to send the invoice too.

[00:34:42] Will Johnson: yeah. AU zero is the authentication and authorization platform for developers. Anything that you need to do with authentication and authorization, whether that’s, connecting social logins, securing AI agents.

[00:34:56] Will Johnson: We handle it with our SDK, so you don’t have to, so you can [00:35:00] get back to doing the fun stuff you like, like programmatically hiding stuff with CSS.

[00:35:05] Adam Argyle: Well done on the fly. Integration with my preferences. Nice. That’s good stuff. I really like Passkey, the passkey work.

[00:35:17] Will Johnson: Yeah. Passkey work in our, Integration with is pretty simple. Like it is just a, just a click of a button in the, in the dashboard and you got pass keys. there’s like someone on Twitter who’s has like a brigade against pass keys. So it’s like anytime we post something on pass keys, they’re like right there talking about how bad it is.

[00:35:37] Will Johnson: It’s, it’s been like, and it, the consistency is insane. Like, I would like to be dedicated to a mission like that. Like intensely as that.

[00:35:47] Robbie Wagner: I don’t understand how pasky work really, because it’s supposed to be more secure. But like it is way easier. I can just like save it in my one password and [00:36:00] log in with that pass key on like any device, which I think kind of breaks the way it was supposed to work.

[00:36:04] Adam Argyle: Will, one password can emulate a pass key.

[00:36:07] Robbie Wagner: yes. Yeah, you can save it there and use it on every device, which is dope.

[00:36:11] Robbie Wagner: So like,

[00:36:12] Robbie Wagner: it seems like, you know, it’d be counter, like, it’d be against the ethos of how it was supposed to work. Of like, you’re supposed to have another device and it’s supposed to like. Use

[00:36:20] Adam Argyle: A very physical scenario. Yeah.

[00:36:22] Robbie Wagner: But it’s like, nope, you can biometric into , one password. And that counts, I guess.

[00:36:27] Robbie Wagner: And then you

[00:36:28] Robbie Wagner: just say, use it and it just works.

[00:36:29] Adam Argyle: that makes sense. So you still have to bio into.

[00:36:33] Adam Argyle: One password in order to get there. Okay, so there’s still a bio check. There’s still like something kind of still fingerprinting you in a way that’s like pretty physical.

[00:36:42] Robbie Wagner: yeah. But

[00:36:43] Adam Argyle: that’s a little less concerning.

[00:36:44] Robbie Wagner: yeah,

[00:36:45] Will Johnson: you know, it’s a public and private key pair, so like the private key is stored on the device, or I guess in one password. I’m gonna be honest, I’m not familiar with how, uh, one password does it, but if they store it there, then like, no one should have access to [00:37:00] that. Just like if it’s stored on the device.

[00:37:01] Will Johnson: No one would have access to that, like, you know, from the web. And so they check against each other and then if it matches, and then that’s why, it gets you in. So as long as no one has the private key that’s stored, like on device, , then you shouldn’t have any issues.

[00:37:16] Will Johnson: But I, I get why it seems like. cause it’s not just the pass key, if it was just the pass key, by itself just out floating on the internet, I understand why that would be concerning, but it has to have that match in order for it to let you in.

[00:37:30] Robbie Wagner: Yeah. Yeah, makes sense. It just feels too easy when stuff is easy to log into. I’m like, that don’t feel

[00:37:35] Robbie Wagner: right.

[00:37:36] Will Johnson: Yeah. Yeah. I get what you’re saying. I get what you’re saying. Yeah, I think even me, like before I started working at Off Zero and I didn’t know how it worked, I was kind of like the same way. I was like, oh, I’m never using my face ID or fingerprint. But now like I like use it for every, like, now that I know, like how it works and what it does, then like I don’t, you know, I, I have no issues.

[00:37:59] Adam Argyle: [00:38:00] Yeah, auth is so weird. It’s still mostly unsolved. , We have more services and more options, but we’re not necessarily in a scenario where. It’s impenetrable. people can still lose stuff. They still ask people to store backups on their computer and like a, it’s like a, basically a sticky note. You stick in your hard drive.

[00:38:17] Adam Argyle: You know, like that’s more secure here, keep this sticky note in your hard drive. I’m like, okay. that’s totally not recognizable by, uh, seal Life. It wanted to crawl through. Funny. I mean, it’s kind of nice though that they’re all out there. , You do trust a SaaS service for your authentication because there’s just too many considerations.

[00:38:34] Adam Argyle: It’s kinda like your CSS, you just trust specialists is kind of the deal at the end of the day. Right? there’s too much niche information these days. Computers feel simple only because specialists have made all of those things feel that way. We’re in a very pampered scenario. A lot of times, and auth is one of those scenarios.

[00:38:52] Adam Argyle: Auth zero. Just pampering devs. There you go. It’s Pampers for Devs Auth, Pampers,

[00:38:57] Adam Argyle: uh,

[00:38:58] Will Johnson: Yeah, exactly. soft, [00:39:00] cloudy pampers

[00:39:01] Adam Argyle: diapers for your login. Get

[00:39:05] Adam Argyle: I.

[00:39:06] Will Johnson: But yeah, and that’s kind of like the fun about it too. Like, you know, I’ve been here, you know, for four years and seen. So many different iterations of like, you know, sies was like a big thing. And then, you know, , when like there was the whole Web3 thing going on and like using web wallets to

[00:39:22] Will Johnson: like

[00:39:22] Will Johnson: log in for a long time. People that was, that was going to be like the way people like log in. That was like a big thing. I know people say auth and it usually means like authentication like by itself, but then there’s like the authorization. Part, you know, of like permissions and what they’re like allowed to do.

[00:39:38] Will Johnson: And that’s like, you know, ever evolving. so it’s kind of been, you know, interesting to see like that change like going from like role based authentication, then relationship based authentication or authorization. My bad, even, I get ‘em confused sometimes, but, uh. Yeah, like going from that and then like, there’s things like FGA, like we have off zero [00:40:00] S-G-A-F-G-A, that’s based off of like the Google Zanzibar.

[00:40:03] Will Johnson: So, that’s like fine grained authorization. When you think of like Google Drive and, , does the team have access If Will is Adam’s manager. Does Adam get access to this document instead of giving like everybody, their own things and stuff like that.

[00:40:18] Will Johnson: So that’s also been like interesting to see that, like you said, it hasn’t been solved yet because there’s just, there’s so many things to consider. There’s more and more users every day. There’s more and more people attacking every day. So it’s been like an exciting space to be in just to kind of watch all this evolution and still like not know like what’s going to be.

[00:40:39] Will Johnson: The winner, right? Like even, you know, I still don’t know who’s going like, and none of these things. I don’t know what’s going to be the off winner. ‘cause yeah, Passkey is hot, but it might be something else that come out two years from now. So it’s been fun.

[00:40:51] Robbie Wagner: Yeah, always evolving.

[00:40:53] Adam Argyle: Yep. You make authentication sound cool but you’re right, it’s not. It’s, it’s not done, and even permissions are still not solved. [00:41:00] Like that’s one of the hardest things. You go into AWS, you go into Google Cloud services. Even you go into Netlify, you go into your Google Doc and you’re like, who has

[00:41:06] Adam Argyle: access to this? I was just showing my kids this the other day, and they, they’re making a Google Doc to make their own Pokemon cards. I’m like, Hey, you do data entry. You define the Pokemon name that hp, its moves and all that stuff. I’ll make you a card. And so then they go in there and I’m like, , they got a couple cards ready and gotta share.

[00:41:22] Adam Argyle: It’s just that stuff is so complex to them. They’re just like, what is going on with permission models? Like, why do you need access to my thing? And I’m like, you, you should give me limited access too. so funny.

[00:41:32] Will Johnson: Yeah, I think like the Google stuff’s kinda like the best way to teach someone like that ‘cause it has so many like different, options and it kind of, you know, shows you just how granular it can be.

[00:41:43] Robbie Wagner: , Yeah, what would you like to plug? Will, what do you got going on? Auth zero, I guess, but like, you know , where can the people find you? , Yeah, what do you wanna mention before we end?

[00:41:52] Will Johnson: I mean, you can find me, , on Twitter at will johnson io. I joined that thing, , the name wait list thing. ‘cause I [00:42:00] want to get the IO taken off so it can just be Will Johnson. The other Will Johnson hasn’t used Twitter in like eight years, so wish me luck on getting into, but for Will Johnson, but for now.

[00:42:11] Will Johnson: it’s Will johnson io and uh, and I like the plug, I mean, you know, definitely the off zero AI stuff. So we just launched into like general availability, the Off Zero for AI agents. You can get that@offzero.com slash ai and it’s basically authenticating your agents, giving them the proper permissions to access things.

[00:42:34] Will Johnson: Storing like your tokens and API keys, so you’re not giving them to the, , AI agents yourself, which I’ve, I’ve seen people do. , So please don’t do that. , Use token vault and, you know, save those somewhere securely and you know, let the exchange happen with off zero so you’re not liable. and also we have, Like a notification system. So if you wanted your agent do like a sensitive action, it can alert you whether email, phone [00:43:00] call, text notification, like whatever you choose for, you can actually approve it before it takes that action. So yeah, you can check out all that stuff.

[00:43:07] Will Johnson: We got quick starts, sample apps, all of that@officezero.com slash ai.

[00:43:12] Adam Argyle: Nice. I have one final question. Is, , AI user or our AI users, are they users? you gave them permissions, but how do you put that in the database? ‘cause they’re not people. They’re just, I, I guess they’re an account. I don’t know. It seems weird, that now we have AI logging in and doing all these things.

[00:43:30] Adam Argyle: you can call them agents. There’s yeah, you can’t see them. You know, they can never ask for s stuff. Like, are they a primary amount, like in your analytics, are there more agents signing up every day than people? Is that like a thing that even happens?

[00:43:44] Will Johnson: I don’t think it was, there’s more agents sign signing up than people, but I feel like a lot of people are, using agents and. kind of letting them do stuff. So that’s kind of why we came up with the Officer Zero for AI agents just to kind of, rein it in. it’ll get [00:44:00] assigned, you know, an identity and everything like that.

[00:44:02] Will Johnson: So that’s how like gets kept track of, and you know how the permissions get, you know, the guardrails get put on it and everything like that.

[00:44:09] Adam Argyle: Makes

[00:44:10] Robbie Wagner: Yeah, that

[00:44:10] Robbie Wagner: sounds smart. I’m sure a lot of people were just giving it like a, um, they made their own account and gave it at their credentials and like, oopsie, it

[00:44:18] Robbie Wagner: broke some stuff. So, yeah, that

[00:44:20] Robbie Wagner: sounds, uh. Sounds better.

[00:44:23] Will Johnson: yeah, that’s pretty much what was happening. I mean, I even seen like conversations on Reddit and someone was like, are you guys just giving your API keys to the agent? And it was like hundreds of replies and most of them were like, yeah. And I’m like, oh

[00:44:40] Robbie Wagner: Yeah. Yeah. Those are some trusting people. That was not, not a great idea.

[00:44:45] Adam Argyle: YOLO mode plus API keys equals some other kind of mode that is not just YOLO anymore.

[00:44:51] Will Johnson: yeah,

[00:44:51] Will Johnson: beyond. Yolo upside down, Yolo.

[00:44:54] Adam Argyle: nice. The stranger Yolo,

[00:44:56] Robbie Wagner: Yeah.

[00:44:57] Will Johnson: Yeah.

[00:44:58] Robbie Wagner: All right, cool. Yeah, [00:45:00] we’re about at time here. Uh, yeah. Thanks Will for coming on Thanks everyone for listening. If you liked it, please subscribe. leave us some read and reviews. We appreciate it, and we’ll catch you next

[00:45:09] Robbie Wagner: time.

[00:45:09] Outro: You’ve been watching Whiskey Web and Whatnot. Recorded in front of a live studio audience. What the fuck are you talking about, Chuck? Enjoyed the show? Subscribe. You know, people don’t pay attention to these, right? Head to whiskey.fund for merchant to join our Discord server. I’m serious, it’s like 2% of people who actually click these links. And don’t forget to leave us a five star review and tell your friends about the show. All right, dude, I’m outta here. Still got it.