141: Secrets Exposed: The Art of Keeping API Keys Safe From Developer Slip-Ups with Dante Lex

[00:00:05] Robbie: What's going on everybody? Welcome to Whiskey Web and Whatnot with your hosts, Robbie the Wagner and Charles William Carpenter, the third.

[00:00:15] Dante: I love the name.

[00:00:18] Chuck: Yeah, yeah, it makes me sound more important than I am in real life.

[00:00:22] Dante: I'm actually Alexander the third as well.

[00:00:24] Chuck: Ah, love it.

[00:00:26] Robbie: Okay.

[00:00:28] Chuck: we're competing thirds.

[00:00:29] Robbie: Yeah. Yeah. So our guest today is Dante. How's it going?

[00:00:35] Dante: Yeah, I'm good. How are you guys doing?

[00:00:37] Chuck: Excellent.

[00:00:40] Robbie: Yeah. Do you want to, Give a few sentences about who you are and what you do.

[00:00:45] Dante: Yeah. So Dante and, the founder of onboard bays and proxy vaults very recent. And basically we build security infrastructure for distributed teams, [00:01:00] right? For example, a scenario. Have you ever would you buy a brand new Tesla and give the keys to your car to some stranger of the street of San Francisco?

[00:01:12] Chuck: Not in San Francisco, but if I was in like Austin or Washington, D. C., I would hand it. They're all trustworthy in Washington, D. C., so I would absolutely give it away there.

[00:01:23] Dante: Well, you won't be any different from businesses today. I mean, they give the keys to the kingdom API keys and database credentials to developers all the time, as you mean absolute trust. But newsflash developers are not secure by default. So why are you doing that? And so we recognize this error in the system and built solutions for it.

[00:01:42] Chuck: Nice, very cool. I definitely already have questions there, but I cannot ask those questions sober.

[00:01:50] Dante: Okay.

[00:01:51] Robbie: yeah, let's let's do some whiskey. But yes, we have we have all checked secrets in to get before I feel like so oops. Yeah

[00:01:59] Chuck: [00:02:00] In 20 something years, yeah. There's definitely not been databases with PII on my laptop before. Definitely not. Off of a VPN or anything else. Alright, so today, folks, we are having the Woodford Reserve double oaked. It is 90. 4 proof it is not age stated, because Woodford likes secrets, but the mash bill is 72 percent corn, 18 percent rye, and 10 percent malted barley.

I believe it's probably a four to six year age. Brown Foreman distills it and they also are the distillers of like, Old Forrester and Jack Daniels, you may have heard of those. This one's special secret sauce is that they do the original aging in brand new charred oak barrels and then they do a second aging in another brand new charred oak barrel because they like to waste?

I don't know. But apparently it gives it some additional flavor, yeah, exactly. I have no idea how long the second aging is, also it's a secret, so, you [00:03:00] know,

[00:03:00] Robbie: Yeah, like, why not just let it I guess they're thinking most of it, like, comes off quickly, so, like, switching it to a new barrel makes it more intense oak or something? I don't

[00:03:09] Chuck: Potentially, I mean, that's like the ideology behind the whole, you know, brand new oak barrels to begin with, is that it doesn't take as long when they're not used, and then you don't have to get as deep into the wood, but I don't know. I like the coffee cup flex there. You're like, listen this could be tea,

[00:03:28] Robbie: Yeah.

[00:03:29] Chuck: could be whiskey, who knows.

[00:03:33] Robbie: smelling some, sour gummy worms.

[00:03:36] Chuck: I

[00:03:37] Dante: yeah.

[00:03:38] Chuck: get more of like a lemon juice, leathery mix in my smell.

[00:03:43] Robbie: that's what I

[00:03:44] Dante: Get more lemon. Yeah.

[00:03:47] Chuck: lemon juice, like kinda Yeah, I don't know. Alright, I'm gonna prime the taste buds. I mean, it's been, I don't know, about 24 hours since

[00:03:56] Robbie: Mm mm-Hmm. .Yeah. A [00:04:00] lot of drinking this week.

[00:04:02] Dante: This is actually my, my whiskey cup.

I

[00:04:08] Chuck: it.

[00:04:08] Dante: yeah, I try. Hmm.

[00:04:13] Chuck: Oh, go ahead. Sorry, I'm just making

[00:04:14] Dante: Interesting. No. Interesting. Usually I go with Glenn Fittich, but

[00:04:21] Chuck: Oh, okay. Yeah, yeah, so more scotch than

[00:04:25] Dante: Yeah.

[00:04:27] Chuck: Yeah, nothing wrong with that. I mean, except for everything, because I'm from Kentucky. No. Yeah, I still get a little lemon juice in the flavor. And Let's, Definitely some sweetness there,

[00:04:42] Dante: Yeah,

[00:04:42] Chuck: Like Like a lemon starburst. Thanks for watching! A little bit, but not as tart for me.

[00:04:54] Robbie: Yeah.

[00:04:55] Dante: I feel like I'm going to be very productive after this call. [00:05:00] Yeah.

[00:05:03] Chuck: well. It's going to get worse for me too, because I live in Arizona and we don't do daylight savings time, so everything, every, yeah twice a year my life and schedule are ruined. I'm coming up on that, so I'll be drinking even earlier.

Yeah, I'm not

[00:05:20] Dante: I mean

[00:05:20] Chuck: located, but

[00:05:22] Dante: that there's a saying that says if you want your weekend to last longer, start drinking on Wednesday.

[00:05:28] Chuck: Nice. And there you go, and here we are. So yeah. I hope you are not beholden to some VCs or anything of that nature to be productive for the next couple of days. If so, we're sorry.

[00:05:43] Dante: It's all right. . No.

[00:05:46] Chuck: Hmm. Yeah.

[00:05:49] Dante: Interesting.

[00:05:50] Chuck: I, I, I stand, I hold, whoa, yeah. Robbie's having a hard time. I hold

true with the. Oh, yeah.

[00:05:57] Dante: Mm.

[00:05:58] Chuck: Yeah, wrong pipe, wrong pipe. [00:06:00] The finish is still kind of leathery for me, or maybe, I guess, straight up oaky. Double oak. I mean, just right to the point. Sometimes it is what it says, and sometimes it's some weird made up thing.

[00:06:10] Robbie: for double oak it doesn't seem that oaky honestly

[00:06:13] Chuck: No, not crazy, but it is like an oak like finish. Yeah, I don't know, it's actually kind of smooth, but it's

[00:06:21] Dante: down well.

[00:06:23] Chuck: yeah. I wouldn't say there's a lot of depth there, but, yeah, it's not bad. So you may or may not be familiar, Dante, with our highly technical, tentacle scale, so it's 0 to 8 tentacles, 0 horrible, please never give me this again, 4, meh, you know, it's not bad, I wouldn't kick it out of bed, and 8, it is amazing, and I will never have any more Glenn Fittich or any other Glenn of that

nature.

Yeah.

[00:06:52] Dante: a seven

[00:06:54] Chuck: Whoa, you're

[00:06:54] Dante: Probably a seven.

[00:06:55] Chuck: Yeah, you like it. Okay.

[00:06:57] Dante: do like it,

[00:06:58] Chuck: Alright. [00:07:00] Yeah, you're like, you can't go full 8.

[00:07:04] Dante: Yeah, but it's a seven. It's good.

[00:07:07] Chuck: fair

[00:07:08] Dante: good.

[00:07:08] Chuck: What do you think, Robbie?

[00:07:10] Robbie: Yeah, I think for like what it is it's pretty good like a bourbon II bourbon is like You know, it's, it, it doesn't have a lot of complexity, I feel like, but like, in terms of bourbon, it's executed well. So I, I'm going to give it a six, I think.

[00:07:32] Chuck: Okay, fair enough. Well, for me, so I do think it is, I mean, it looks, it looks nice coming to a party. I like the price point about it, too. That is is is good. It's reasonable. Things can get nuts these days. If you get anything under 60 bucks I feel like you, you're almost getting a steal as long as it's tasty.

I do think it lacks a little complexity for me in terms of bourbons. Obviously we drink a shit [00:08:00] ton of, of this so I've got a lot to compare to. So to me it's like, it's not bad as a sipper. I actually think it might make some very decent like one or two ingredient cocktails. Like. That'd be nice like in a whiskey sour with this with like bring out those lemon notes or whatever else so for me in that sense, I think I give it a five It's like above average, but it's not it's not swinging for the fences for me.

But again, this is all subjective There's no right answer anyway

[00:08:28] Dante: Yeah. But I would recommend it. So

[00:08:31] Chuck: Yeah, yeah, I I mean woodford's always like It's nothing to be ashamed of. There's nothing they're putting out there that is like, oh, this is bad. I mean, absolutely, like, anything I've tried from them has always been, like, pretty decent. I just have a personal story and a vendetta slightly against them because I was at the distillery doing a tour.

Gosh, when will this have been? I mean, at least, And we, we were in there and we're doing the tour and this [00:09:00] guy, Earl, was our tour guide and we get like kind of far down the tour and he shows us, it's a thing called a whiskey thief. It's like this copper thing that you put in there. You just like put your thumb on it and you get some out and put it in the glass and that's just like how they try it.

And they show us that and then they pass the glasses around. And And until it gets to us, and myself, my brother, and a friend, and it gets to us, and he's like, Oh, well, you guys, actually I'm, he grabs the cup before it gets to us, pours it back in the barrel, and then we can just smell the like, whatever's left.

And we were like, Earl is a dick! I wasn't gonna take a drink, but if I get another chance, I absolutely will. And then I was just like, to hell with Woodford for a while. So anyway, that's my

anecdote about them. Yeah. Jerks. Yeah, whatever.

[00:09:50] Dante: Me

[00:09:54] Chuck: hot takes?

[00:09:56] Robbie: Let's do it.

[00:09:57] Chuck: Let's do some hot takes. I [00:10:00] will start because the second question is Robbie's

favorite and he always yells at me if I take it.

So in TypeScript, do you prefer explicit types or inferred types? That assumes you use TypeScript, maybe you don't. I dunno.

[00:10:20] Dante: or Robby?

[00:10:23] Chuck: Oh,

[00:10:23] Robbie: you.

[00:10:24] Chuck: what Robbie thinks.

[00:10:25] Robbie: Yeah.

[00:10:26] Chuck: who cares what he thinks, really,

[00:10:27] Robbie: Yeah.

[00:10:29] Chuck: Yeah, so you,

[00:10:30] Dante: Explicit. I prefer explicit for security reasons. Yeah, I feel if he leave things too open, there's a whole lot open for translation, especially when working with a team of devs. You, you can imagine, oh my God, the things that can go on when you don't. So it's like this, right? Developers are so smart and amazing.

[00:11:00] That's even when you have security in place, they can go above and beyond it. Right. Like literally break it. Now, imagine when you don't have things explicit, it's chaos, almost chaos at least.

[00:11:11] Chuck: Yeah, I could see that potential. I've definitely broken the rules many a times for my own preference and convenience. So Yeah.

[00:11:20] Robbie: Yeah.

[00:11:22] Dante: you guys?

[00:11:23] Robbie: Well, most things, it depends, but I tend to prefer inferred cause I'm lazy. I don't want to have to type as much, so I just let it like someone else decides for me.

[00:11:36] Chuck: And there you go. And there you have It

[00:11:39] Robbie: Yeah.

[00:11:40] Chuck: great answer, though.

[00:11:41] Dante: Fair enough.

[00:11:41] Robbie: Yeah. Yeah. Our next one is Tailwind or Vanilla CSS. Yeah.

[00:11:54] Chuck: out here, so

[00:11:55] Dante: Yeah, so, So I've done vanilla [00:12:00] CSS for a long time, but Recently I've become a Tailwind developer. I would not go back to vanilla CSS. It takes so much time and you, so Tailwind for me, definitely Tailwind, right?

[00:12:15] Robbie: Nice.

[00:12:17] Dante: Yeah, it's, I could, previously I could spin up websites in maybe a couple of days, but with Tailwind I can do it in minutes, literally minutes.

So, yeah.

[00:12:28] Robbie: Yeah. Yeah. I totally agree with that. Tailwind is, I don't get to use Tailwind at work right now and I am so slow at like, I just never want to change the styles of anything. I'm like, I'll make the functionality but it's just going to look how it looks.

[00:12:42] Chuck: I'm gonna avoid that, let the chips fall where they may.

[00:12:45] Robbie: Yeah.

[00:12:46] Dante: Yeah, I don't know how I've lived without Tailwind for so long, but

[00:12:50] Chuck: Well, you were waiting for someone to make it, that's all.

[00:12:53] Dante: Yeah,

[00:12:54] Robbie: yeah,

[00:12:54] Dante: yeah,

yeah, this one.

[00:12:57] Chuck: rebase or git [00:13:00] merge.

[00:13:00] Dante: Ah, okay, I use Merge a lot, so I might be biased towards it, because I use Merge more than Rebase.

[00:13:11] Chuck: Yeah.

[00:13:12] Dante: ah, yeah, I'll definitely go with Merge.

Yeah,

[00:13:17] Chuck: Yes,

[00:13:18] Robbie: Yeah

[00:13:19] Dante: hmm.

[00:13:20] Robbie: They can both be used wrong. Like, you know, so like I I think the the real answer is like what your commits look like at the end of the day because If that's clean ish, it doesn't matter what you're using It's just like, know, it's personal preference

[00:13:41] Dante: well, true. It's become a person for first. So I tried to make sure my commits are clean, but I just never think rebase, just never think rebase. Yeah.

[00:13:54] Robbie: Yeah, so I'm going to skip this one. Sidebar on the left or [00:14:00] right in VS code.

[00:14:02] Dante: So,

[00:14:03] Robbie: code.

[00:14:04] Dante: Yes, I use, I use

VSO. So, sidebar. So when you say. is it the, folder view or

split screen? the folder view or the File

view? Def definitely on the left. Definitely on the left. So, and I don't know that maybe that's, I don't know about all that, but that's kind of how I read, I read left to right, so I prefer a lot of what I'm doing to start that way.

But

[00:14:37] Robbie: Yeah.

[00:14:37] Dante: profess side, I dunno about.

[00:14:41] Robbie: I haven't encountered someone that has moved it yet. Like I've seen people online that say they've moved it to the right side, but I'm like, I haven't talked to a person. So I think it's just like a couple of people did it and then people are like, wait, why would you do that? And they're like, there's a big [00:15:00] big thing on Twitter after that or something.

[00:15:02] Chuck: out of the

[00:15:03] Dante: I, have one for

[00:15:04] Chuck: I

yeah.

[00:15:05] Robbie: Oh yeah.

[00:15:06] Dante: for you guys.

[00:15:07] Robbie: Yeah.

Yeah.

[00:15:14] Chuck: question, I'm gonna say VS Code. I am, I'm NeoVim curious. That's what I would say. Is I've seen enough content on Twitter where I'm like, This seems cool. If I ever have any time, which is never, would love to maybe go through it and see what I think. But,

[00:15:29] Robbie: Yeah. I think it's the same as like, I have a, the really fancy split Kinesis 360 keyboard thing. And every time I try to learn it, I'm like, I need to actually write code today. So I'm going to go back to my other keyboard. I feel like the same thing would be true with NeoVim. It's like, this is very powerful, but do I have a year to like actually get used to it?

[00:15:50] Chuck: Yeah

[00:15:51] Robbie: use VS Code?

[00:15:52] Dante: Yeah, I'm just lazy. I'm not using Neo Vim.

[00:15:55] Chuck: Yeah.

yeah I mean It's probably been like a good [00:16:00] decade or so that I've been since I was initially impressed with like How efficient a good vim user can be and I still haven't done it. So, you know, it just goes to show That's probably I don't know not a priority for me

[00:16:14] Dante: think people who use NeoVim are more hobbyist or just trying to try it out at the moment

[00:16:21] Chuck: Mm hmm

[00:16:22] Dante: more productive with it. That's kind of, those I've seen at least.

[00:16:26] Chuck: Yeah, I wouldn't say, I wouldn't tell you, say that to Primogen.

[00:16:29] Robbie: Yeah, Primogen would disagree. Yeah.

[00:16:31] Chuck: He would disagree. He has got some videos as to why and how he is so much better with it. And in his case, I, I, I see that that's true. I just don't know how, like, I go from zero to even 50 percent of that in any efficient way. Yeah.

[00:16:48] Dante: Hmm.

[00:16:51] Chuck: more for you. I love that you turned it around and back to us though, but I'm, you know, you're not getting out of this last one. You think about nested [00:17:00] terraries? If you saw a pull request, or maybe you're responsible for said pull request, that had like, three, four levels deep of nested terraries, what'd you think about that code?

[00:17:15] Dante: I'll reject it.

[00:17:16] Chuck: Yeah. So we

[00:17:19] Dante: not reject. Yeah, no,

[00:17:21] Chuck: like, you're fired! You're

[00:17:22] Dante: no, I'll just ask them to rewrite it. It's, I don't think that is efficient code. Right. It's even when I'm writing. HTML. Yes, that's right. I don't go that deep. I don't feel it's sufficient code. It takes too long to hit the dumb and no,

[00:17:46] Chuck: Yeah.

[00:17:47] Dante: I can understand why you might do it, but it's a no for me.

Like, you know, there are better ways to go around it, like literally better ways. But it can be the same [00:18:00] argument with for me, okay. My div is everything. My div is a span. My div is sometimes an a tag, like,

[00:18:08] Chuck: So semantic HTML is the question we should have asked. I see. Okay.

[00:18:14] Dante: so yeah, so, but yeah, it's, it's

[00:18:18] Chuck: just a quick tangent there. Cause you said that's going to be a no for me and I didn't even really watch this show, but that's a whole like American Idol, Randy Jackson. He'd be like, it's going to be a no for me, dog. Had you, had you finished it with a dog, I would have been really, I really impressed. So just throwing that in there.

[00:18:37] Dante: well, yeah, that was a curious question because, I think I've only encountered it once working with someone. Like, fall out, fall next to, like, I've only encountered it once. And, when I saw it, my brain began to just, why are you doing this? That's [00:19:00] literally my, like, the first thing, like, why are you doing this?

And, I understood why, but I could saw, see that I could write it in some way different, and it just, dude, just change this place. It's, I, I don't want to wake up tomorrow and ask why again.

[00:19:16] Chuck: yeah, yeah, that's the thing is like you come back to it later or even if in the moment you take the time to kind of read it and break down the, you know, the whole like decision tree

there.

[00:19:27] Dante: it's, it's a lot of cognitive loads going through it, so,

[00:19:31] Chuck: Right, right. And if you are someone that has to like support that over time or understand it more than once, it just feels like that's already like if, if I have to. really get deep to break it down to just review that code, then that's already a fallacy. So I don't know. My

[00:19:52] Dante: it's fine, it's fine.

[00:19:55] Chuck: right.

[00:19:57] Dante: Well, simple is simple is [00:20:00] complicated, I've found. Yeah,

Yeah, simple is quite complicated,

Yeah,

[00:20:06] Chuck: that's the fun part.

[00:20:07] Robbie: Yeah. So, speaking of simple or complicated, tell us About onboard base and how you manage all of these secrets and things. People should not be passing around. Tell, tell us more. Yeah,

[00:20:28] Dante: software engineer and a product designer, and I've worked a lot as a contractor, as an engineering lead or part of an engineering team. And something that happens so often was I get copied and pasted environment variables of email or slack.

[00:20:46] Chuck: Yeah.

[00:20:47] Dante: fun! But that is literally a data breach waiting to happen.

It's just waiting to happen, right? And um, and I've seen a data breach happen as one of the companies I've worked at and it's not pretty. [00:21:00] Everyone is on hands on deck, sometimes most people don't even know what to do. And I tell people that if you manage environment variables, well congratulations, you are a security engineer.

Because you have to find a way to secure that. Right? And so we built Onboard Base to not intrude on what you do. But to sit as a secure layer on top of your infrastructure, your CLI, your SDK, your server infrastructure, just sit there and just push the secrets everywhere possible, even down to your local code base where engineers need them, right?

So to avoid any copy and pasting going on real time. So we just basically remove that. But it's hard, we've seen hard adoption because people don't want change. People don't like change so it's been tough. It's, it's hard to sell to developers. It's even harder to sell security to developers.

[00:21:58] Chuck: Right.

[00:21:59] Dante: [00:22:00] and I found that one of the reasons because security is not a KPI for a lot of teams.

Until you get to that scale.

[00:22:07] Chuck: You ready?

[00:22:08] Dante: And so We, as much as possible, have made Onboard Base so seamless that it's becoming a no brainer to use, right? You store it in the store, you pull it anywhere that you need it real time, and we don't show those secrets anywhere, right? Developers work without seeing it, they just have it when they need it, right?

And, we began to see energy tech companies really adopt it, which was a bit weird when we first noticed it, but We've seen more energy tech adopted and that's largely because they have a lot of infrastructure and they're working with more extended distributed teams. So it was really, really fun to know and, yeah.

So for me, it's an interesting project and something I, I wake up to every day wanting to improve. It feels like it's a [00:23:00] piece of me, like Dude, I built this for you. So,

[00:23:05] Chuck: Yeah,

[00:23:06] Dante: Yeah, so yeah, so, It's fun and can be frustrating at times. Because one, we are a single point of failure. Meaning we can't afford to go down.

Literally can't afford to go down. So, High availability is number one. For us. And for that we have to really maintain a lot of server costs. So we have multi cloud servers. So, Switching once any one of them goes down, but we almost never go down. So, yeah, it's, come a long way actually. And we're still trying to, I would say find product market fit.

We have customers paying customers, but I don't think we are there yet. And, a lot of learnings we got from on my base is what is translating into proxy vault now.

Right. Yeah. So, [00:24:00] the way I see proxy vault is we've identified that humans are going to make mistakes. There's no two ways about it.

Right. Whether you like it or not. So we decided, okay, let us attack the surface areas where these mistakes happen, which starts from API keys, database, credentials repo, assess command line in production. Imagine running commands in production. How scary that must be

[00:24:26] Chuck: Yeah,

[00:24:27] Dante: migrations in

production. Yeah. And a lot of them don't do it well, and you see some of them, SVA goes down for hours. It's, it's scary.

[00:24:37] Chuck: Yeah.

[00:24:38] Dante: And so that's what proxy vault is trying to address for that niche particularly. Yeah. So that's how far we've come to date.

[00:24:48] Chuck: Yeah, very interesting that rather than a pivot, you're like, I see through your initial customer base, right? And then you see a need that is adjacent, but not exactly the same. And you're [00:25:00] like, Well, I think we can kind of buckle these together. Right? Yeah. Very

interesting. And it is all cloud all the time.

Or is there on prem versions? Is there? Like, what do you do? I'm curious how that I can see where this fits in, like, in from an infrastructure perspective. So I guess I have like twofold. One is when that infrastructure isn't cloud based, is there an opportunity there? And then conversely that you, you spoke a lot to like distributed teams and stuff.

So my local needs to be like, what if my local, does my local need to be connected to that infrastructure in some way then?

[00:25:38] Dante: So for on Prem, we do have an on Prem solution. In fact, we're working with what could be our biggest customer and enterprise team, right? So we didn't start off as enterprise and we actually didn't want to go enterprise till next year. But we had a couple of enterprise team reach out to us, out of nowhere and decided to [00:26:00] maximize the opportunity, right?

So we have we have security blog. brings in about 10K traffic every month. So that's kind of what most of our customers come from. So the actually the French national energy company, which is, was nice. And so we started conversations with them and they requested for on prem and luckily for us, we already deployed a couple of M prem to some of our customers.

So that was almost no problem going down that conversation. So it's, it's not, something we have not seen before, right? So you can easily deploy on prem self hosting for your needs. If you want the want to be at least guarantee high a at every point in time. And yeah. And for the local developers, right?

So we have something called offline availability even when you don't have Internet.

You can still actively work based on the [00:27:00] offline availability that the admin has set. So we have seven days, two weeks, one month, six months based on the offline availability that

[00:27:09] Robbie: Hmm.

[00:27:09] Dante: admin has set. So if it sets, you can work without internet for that duration.

[00:27:14] Chuck: Oh, that's cool.

Yeah, Very nice that you considered those use cases. Because those feel like some of the edges that would make things more challenging, right? Like, Sass is Sass. People do Cloud Sass all the time, and that's sort of like table stakes really anymore. But, things get harder, right, outside of that.

Yeah.

[00:27:35] Dante: Yeah.

What?

[00:27:36] Robbie: to do on prem for like a lot of companies for them to

[00:27:40] Dante: Oh, yeah.

[00:27:41] Robbie: it. Yeah.

[00:27:42] Dante: Yeah. Yeah.

What?

[00:27:43] Chuck: I think, is like, probably

[00:27:45] Dante: Yeah. Yeah. Mm What helped us though is because we, I use onboard base every day. I don't write a single line of code without it. So it will make sense if I

[00:27:56] Chuck: Right?

[00:27:57] Robbie: hmm. [00:28:00] Yep.

[00:28:00] Chuck: food, they say. I don't know if you're familiar with that term, or phrase. Yeah. Yeah, I think it's a good thing to do. You should understand. What your customers deal with, if possible, right? Like, obviously there's tons of products that may not apply to developers, but this obviously very much does.

And yeah, the developer tooling space, and security in particular, I think, is a great niche to start to become a part of.

[00:28:28] Dante: There are two niches. I think that are very unexplored. One is security. Another is the energy space. The energy grid can literally make everyone null and void. If the energy grid goes down,

[00:28:43] Chuck: Right. Yeah.

[00:28:45] Dante: We're literally

[00:28:46] Chuck: Unless you're a serious prepper, I don't know.

[00:28:48] Robbie: Yeah.

[00:28:49] Chuck: I think Robby's building a he's got a whole, like security bunker,

uh, behind his house.

[00:28:58] Robbie: I don't.

[00:28:58] Chuck: He's been filling it with [00:29:00] whiskey, I don't, I keep telling

[00:29:01] Robbie: I do have a lot

of whiskey.

[00:29:02] Chuck: that.

[00:29:03] Robbie: It has calories, but it's not, not maybe the the best energy source.

[00:29:08] Chuck: Yeah. Your fight or flight's gonna get real slow.

[00:29:11] Dante: Well at some point, I think I would be at a bunker because, the rise of AI, I don't think we're paying enough attention to things, even though we are all excited about innovation.

[00:29:25] Chuck: Right.

[00:29:26] Dante: But, I asked, I was at an event speaking at an event and I asked the audience that so AI makes you productive, right?

[00:29:35] Chuck: Mm hmm.

[00:29:36] Dante: Don't you think it makes hackers even more productive?

[00:29:39] Chuck: Absolutely.

yeah.

[00:29:41] Robbie: Yeah.

[00:29:42] Dante: everyone went mute because I didn't think they have thought about it. Literally went mute because if you make your life easier, it's gonna make their life easier. They're just going to weigh 10 times more easier. But

[00:29:54] Chuck: Yeah. We, uh

[00:29:56] Dante: that part of things and just excited about the innovation [00:30:00] itself, which is good.

But.

[00:30:02] Chuck: it's even made social engineering more efficient, right? Like, there was a thing in the recent US election where there was an AI generated Biden voice calling people throughout America to tell them not to vote at a certain time. I mean, that right there, there it is, making someone's life easier.

Someone else's life harder, but someone's life easier. And I think I want to come back to a point that you made that I think is super important, is that Nobody really thinks about or, I mean, cares about, maybe they care, but like, they're not inconvenienced by security until they are, until, exactly. And I think that's a very important part point to bring up, like, I mean, I'm obsessed with the podcast Darknet Diaries, and so I always hear, you know, listen to those.

Stories about like the worst things happening on the internet over the last few decades and it makes me wonder all the time But then the reality is is that I am aware [00:31:00] of how much I have the steps I haven't take to improve my my personal security and yet it is It's even sitting in front of my face, but I'm not attacked which I will be after this episode airs.

So

[00:31:13] Robbie: Yeah.

[00:31:15] Dante: yeah, no, it is actually true for a lot of people and a lot of teams and teams even more. Right? So I found that Some teams, teams do suck too to become compliant, right? But a lot of them do it for the wrong reasons. They do it because they want to sign a contract, but not for business reasons. And then they forget about it.

Security is an ongoing process. You actually need to continuously improve your security. I speak to a lot of fintech companies and they think because they've gotten their software, they are safe. Oh my goodness.

[00:31:55] Chuck: Yeah. They were, they were safe

[00:31:57] Dante: Uh, Uh, Uh, [00:32:00] Uh, Uh, Uh,

[00:32:02] Robbie: you think.

[00:32:03] Chuck: You're right. Yeah.

[00:32:07] Dante: check some of their systems, they do use very random passwords.

They use passwords for passwords they use. Sometimes they don't even have passwords because they think everything is on their intranet and should be safe. No.

[00:32:21] Robbie: Yeah.

[00:32:23] Dante: It's, uh,

[00:32:24] Chuck: someone gets access, again if, if you're not

[00:32:27] Dante: yeah.

[00:32:31] Chuck: It's, it's crazy the stuff that people get access to once they get past just one or two very menial security measures. So, yeah,

[00:32:44] Dante: Yeah. So that, that's one of the reasons why build on bus base, at least to protect the developer layer to begin with. And yeah. And we keep shipping out security tools after security tools just to, you know what we we're not [00:33:00] even asking to pay for it, just be secure at this point, , that's kind of how some of our security tools have been targeted.

So, yeah.

[00:33:07] Chuck: Is anything open source? Okay.

[00:33:11] Dante: We have one for terraform states. You know, a lot of people use terraform states, but they put those terraform states in their code base. Like, literally, it's just there. Yeah. So, what we did was we helped them encrypt it in Transient and at rest.

That's what that does. And you can just continuously use it. So it's free and open source. And then we did another one, so you don't have to Mistakenly leak sensitive information through console logs to production. can imagine how many console logs I remove from code bases every day. And some of them have keys leaked into it.

And those things make it to production. So, there's something called, yeah.

[00:33:58] Chuck: sometimes it's [00:34:00] sensitive information. I I'm sorry. Yeah.

[00:34:03] Dante: And uh, yeah, that's it.

[00:34:05] Chuck: and I still do the same shit.

[00:34:08] Dante: Yeah, that's true for a lot of people and that's what console log address and it's open source. It's actually one of our most studied people. Yeah, so we try as much as possible to do open source and of the things we open source are internal tools we built to use ourselves and just push it out.

[00:34:26] Chuck: Very cool. Very cool. Robbie looked like he was about to say something, so I paused. He, he always tells me I talk a lot, you know, and so I'm just trying to be

I try to be a good partner to my gho to my ghost. And he gets distracted when I talk. He's like, oh, that guy's talking again. Whatever else. Yeah, okay. So that all, like, kind of tracks and makes sense to me.

Like, sounds like very cool stuff. So, obviously, best of luck. So, luck to you around that, but we are also like [00:35:00] curious, for no personal benefit whatsoever about starting your own company. Starting your own software company. Like, what does that look like? What is that journey? How has that been for you?

Was on onboard base your first?

[00:35:15] Dante: It's the first official one, right? Others are mostly been products really. Thank you. Just here and there in the accompany of my base is the first official one, right? It's been tough right and I'm a solo founder and I can tell you it's tough to be a solo founder, but If you don't have a co founder, don't bother yourself about it, right?

If you have one, great. If you don't, it's not the end of the world. The way I see co founder relationships, I've seen a lot of them and most of them have ended in heartbreak, but few have [00:36:00] succeeded, right? And my, when someone tells me co founding is like a marriage. I'm like, do you know the average rate of divorces in the U.

S.?

[00:36:11] Chuck: Yeah, exactly.

[00:36:13] Robbie: Yeah,

[00:36:14] Dante: Yeah, so, um

[00:36:16] Chuck: So, there you go. Bear that in mind. Be as selective with

your business partners.

[00:36:22] Robbie: to business partners. Yeah, which chuck we

[00:36:24] Dante: Yeah

[00:36:28] Robbie: Yeah,

[00:36:32] Chuck: with syntax t shirts. I mean, I would absolutely really vet them. So, anyway. Get a

[00:36:39] Dante: Yeah.

[00:36:40] Chuck: and you think you can have a good time and then they want to talk about responsibility.

[00:36:44] Dante: Yeah. And drink whiskey.

[00:36:47] Chuck: you.

Yeah. feel sorry for me. I understand. Exactly. This is this is a tough gig, man.

[00:36:54] Dante: Yeah. So it has been tough with Humber base, especially also fundraising. We've not [00:37:00] raised from VC,

[00:37:01] Chuck: Okay.

[00:37:02] Dante: from angels and Texas. So we've, not raised any round from VC, but angels are very strategic. We have some of the big ones. I have to, I have Zig,

[00:37:16] Chuck: nice.

[00:37:18] Dante: have Dougie and a couple more, you know, so, yeah,

[00:37:24] Chuck: Yeah, so it's a different landscape these days, right? Like a bubble burst in a way across and now sort of the, you know, an idea and growth isn't quite enough to do it, right? Like my understanding and I, I don't have this firsthand as of yet, but you know, you're looking at, you really need to prove business model and you need to prove it in like, ARR kind of thing.

Like, you know, bring the users, bring the money. And

[00:37:56] Dante: yeah.

[00:37:57] Chuck: yeah.

[00:37:58] Dante: Yeah, it's true, and [00:38:00] it's really tough to raise, or, I don't know, it's been tough for me to raise at least. I think some people find it way, way easier to raise, maybe because they can sell better or something,

too. But,

[00:38:10] Robbie: Yeah, that is part of the equation for sure. Yeah. Like I'm a terrible salesman and cause we, we were on a consultancy and yeah, I have a very hard time like selling a client. Like I can talk to them about what we're going to do, but there's something about being like a salesman minded

[00:38:28] Dante: Yeah.

[00:38:29] Robbie: push them over the edge to,

[00:38:31] Chuck: Yeah,

the push, the pressure.

[00:38:33] Robbie: yeah, I don't really know. I don't have that, that nuance

[00:38:36] Chuck: I can create relationships, I can get people to like me, I can like have a good time having a conversation with them, having a

[00:38:42] Dante: Yeah.

[00:38:43] Chuck: you are. And then when it gets to like, okay, are we going to do this? And they're like, I don't know. And you know, I'm not like, well, let's find out. Let me come with you.

Let me talk to your boss. Like, no, I don't do any of those things. And that I think can be challenging. Yeah.

Yeah.

[00:38:57] Dante: you know, you know, and I think [00:39:00] that's how you raise VC these days. A dream that's a lot of times it most never happens.

[00:39:06] Chuck: Right, right. I mean, it's all a lottery ticket, right? They're hedging their bets across the board, and they've just said that, like, the, the ability to get on their bingo card is a little tougher, right? They want

[00:39:18] Robbie: Mm hmm.

[00:39:19] Chuck: for that, for better or worse isn't always about, like, the validity of the idea, but it's maybe about the person behind the idea and how much they've been able to sell it up to that point, right?

[00:39:29] Dante: yeah, yeah, yeah. And at some point I just said, you know what, I'm not going to raise, VCs anymore because the conversations were not productive.

[00:39:39] Chuck: Yeah.

[00:39:40] Dante: I felt that if I had to be on a call to explain to you why security is important, then that conversation is not, is not productive.

[00:39:47] Chuck: There

[00:39:48] Dante: I

[00:39:48] Chuck: That's true.

[00:39:49] Dante: I mean to and it was more straightforward speaking to Angels who use the product and know the problem itself.

So that was [00:40:00] way more straightforward and we've gotten by, by lots. Like, evil has been helping a lot with the design of one of our investors. And so it's been fun, though at some point would consider raising a small round. don't believe in raising money I don't need,

and to an extent that is not good for VC.

[00:40:25] Chuck: Yeah.

Right. Yeah.

[00:40:29] Dante: I would not be forced to raise money I do not need for any

[00:40:32] Chuck: Yeah. I think that's great.

[00:40:34] Robbie: Well, you could

[00:40:35] Dante: Well,

[00:40:39] Robbie: secret keys and be like, just email them and be like, I found this key. Maybe you need my product.

Yeah.

[00:40:49] Chuck: problem. You need red team. Hire a red team. Go expose vulnerabilities and be like, and the solution is here.

[00:40:56] Dante: yeah, that might be legal

[00:40:58] Chuck: That's marketing. [00:41:00] Yeah.

[00:41:00] Dante: Yeah, it's marketing but it might be legal as well, right especially for,

[00:41:04] Robbie: a gray area.

[00:41:05] Chuck: Well, it depends on what country you hire those developers in, right? So, it

depends. As many answers, it

depends, you know?

[00:41:14] Robbie: russia i've heard

[00:41:15] Chuck: Right, yeah. That was my obvious thing too, but I didn't want to like, I don't know. Do you ruffle anyone's feathers by bringing up Russia as a potential hacker?

I don't know.

[00:41:26] Dante: I don't, I don't know,

You know, a lot,

[00:41:29] Chuck: probably on the verge of getting cancelled any moment, so, you know, just

[00:41:33] Dante: Ha ha,

[00:41:33] Chuck: er in, in life, I'm, I'm walking a tightrope.

So it's coming. You know, it doesn't matter if I say I like, you know, Taylor Swift or something. Somebody is mad at me.

[00:41:45] Dante: well, that means you have a voice, so, That's good, A lot of people who get cancer have a voice, So,

[00:41:52] Chuck: So I guess

[00:41:53] Dante: that. Heh, heh, heh,

[00:41:56] Chuck: I appreciate, like, the positivity associated with that.[00:42:00]

So there's a question here. Yeah, you what?

[00:42:02] Robbie: I was gonna say, well, we can spin that into something you actually do like. I don't know if you like Taylor Swift or not. But you guys are both Manchester United fans.

[00:42:13] Chuck: Yeah,

you

[00:42:14] Dante: goodness.

[00:42:14] Chuck: so

[00:42:15] Dante: about Manchester United

[00:42:17] Robbie: Ha ha ha

[00:42:18] Chuck: But we kind of have to just because I don't have an opportunity that often even when we speak to folks in the UK Half the time more than

half the time. They're like,

[00:42:27] Robbie: football. Ha

[00:42:28] Chuck: like, I don't really I don't

like I don't really like football and I'm like There why can

you just I know, like, that's like saying you don't like fish and chips or something, you know, like I, I don't fancy a Bubbles and Squeak.

What do you mean you don't fancy bubble and squeak? That's what's there and it's delicious, exactly. So, anyway yes, it's a hard time for us.

[00:42:57] Dante: Tough.

[00:42:58] Chuck: we're in a massive [00:43:00] transition. And, you know, you, you just have to be, you, you gotta write this one off. This is like a practice season. First of all, 50 percent of the first team squad is injured.

Some of them for like the majority. Of the season, our like number one defender, who has like, Heart of a Lion, he's like 5'6 has Heart of a Lion, just kills it, but, has also killed his I guess it's like a thigh injury or

[00:43:27] Dante: Yeah, it is a tiring, reoccurring

time, dude.

[00:43:29] Chuck: yeah, so like that's not great, plus like new signings that just never really get going, Mason Mount seems like a waste of time, but here we are, people said that, Chelsea fans told us, it's

[00:43:41] Dante: Hmm,

So, Ha, ha, ha, Ha, ha, ha,

[00:43:46] Chuck: Anyway.

[00:43:47] Dante: Oh, man. So when I look at United now, I just I'm sad

[00:43:51] Chuck: Yeah.

[00:43:52] Dante: I still watch the game every Saturday, but

[00:43:55] Chuck: Absolutely. Yeah. I watch every single one.

[00:43:57] Dante: Uh,

[00:44:00] I almost don't know where things are wrong, right? Because I can say it's the quality of the squad because we do have

[00:44:07] Chuck: Yeah. There's no depth. I mean, we have, everybody's hurt and you're playing kids that some have something like, you know, amazing potential, but it's just not ready. And yeah. So this past weekend it was, man, it was the Darby, it was Manchester United versus Man City First 45 looked like we had a, we had a decent plan, right?

But we just couldn't hold it for that long. I mean, so Manchester City won what they call the troubles. So that means like they European champions, they were League champions and then they're the League Cup champions. So you get the trouble out of

that

and

[00:44:42] Dante: FA Cup

[00:44:43] Chuck: that's the League Cup.

[00:44:44] Dante: No, FA Cup is different from, okay. League Cup is the Carabao Cup.

[00:44:48] Chuck: Mm. See, because,

[00:44:51] Dante: We won the Carabao Cup last

[00:44:53] Chuck: Right. Right. But the FA Cup is like every level of the FA. [00:45:00] Oh, right, right. I know what you're saying. Never mind. Yeah, yeah, yeah. I mean like the, the whole like, F, Football Association

Cup. Sorry. Yeah, well, You know, whatever. I, I appreciate the correction. So, I know what I meant, not what I said.

So I was just explaining to Robby as a noob, and our one listener. Our listener probably doesn't have any idea what we're talking about. Anyway, so it's like the, you know, one of the, Top squads in the league and you know, you're expected to get blown away and then you get a false sense of hope that the halftime and then they equalize and then they go up and you're just kind of like, yeah, but Oh, looks like we might, we might, maybe we're going to get a tie here.

And that would

[00:45:41] Dante: Yeah.

[00:45:42] Chuck: in spite of right. Third goal goes in. I was just like, all right, well, I just,

[00:45:48] Dante: yeah,

[00:45:49] Chuck: I'm done.

[00:45:49] Dante: lit. It's a de, it's definition of it is the hopes that kill, literally hope. Like that's kind of how I

[00:45:57] Chuck: Yeah.

[00:45:57] Dante: that game. Man, [00:46:00] I was drinking a bottle of whiskey, so it just literally got me the rest of the day. I don't know.

Yeah.

[00:46:08] Chuck: And yeah, you know, my family and wife feel those effects. Not that I say or do anything, but that's

the point is that I'm quiet and I'm brooding. And they just know like, okay, daddy, not in a good place. We'll give them some time.

[00:46:21] Dante: Anytime my wife sees me like that, she's like so do you guys lost again? Right?

[00:46:26] Chuck: Yeah. So I, I won't, I won't drag the subject on, even though I could probably have a separate podcast just with you talking about this. Cause I have very strong appeal opinions. I, I'm going to ask this question. Eric ten hog in or out.

[00:46:45] Dante: That's a tricky one. So, I would say, right, I would say give him another season, right? And that's me being modest, right? I would say give him another season. Let's see. [00:47:00] But, he has just a number of games to prove himself now. And if he doesn't do that, he doesn't get another season, right? But I can't say everything is down to the players, right?

It's, it's looks like it's the. Patterns themselves that are wrong, right? But the players are not either Beautiful those patterns or are finding it hard to adjust to it And you know how jose moreno has one pattern one way to win

[00:47:28] Chuck: Yep. Yeah

[00:47:31] Dante: to where ten hag is is trying to do something and it's not being flexible or fluid with it.

That's the way I would say it. But yeah,

[00:47:40] Chuck: agree with that I think it's like an unfair assessment in general over the season because he basically Hasn't been able to select his first 11 like I think there's some stat where it's like 10 percent or something at a time like his planned first 11 has just basically never happened and [00:48:00] Tactics will only take you so far and if you don't have squad depth Also a problem.

So you really can't say like his control is tactics, training, preparation, and just the tactics don't apply in this

[00:48:12] Dante: Yeah.

[00:48:12] Chuck: So unless it just is also absolute garbage for the next X number of games, I say another season to let him see out the contract in a better infrastructure, hopefully

[00:48:23] Dante: Mm hmm.

[00:48:24] Chuck: And then we'll see what happens.

Yeah.

What do you want to talk about Robbie? Okay.

[00:48:32] Robbie: the biggest soccer fan. I know so much about it. I had to just keep myself

[00:48:36] Chuck: Exactly. I

can't wait to take you to what is probably your first match. I don't know. We'll see in Miami, maybe the first match. Okay.

[00:48:43] Dante: Oh, like that?

[00:48:45] Chuck: Uh, I am, I don't know if you are, but so we're gonna be in Miami for, yeah, Saturday. So we're gonna be in Miami for React Miami, and

[00:48:53] Dante: Ah.

[00:48:54] Chuck: a a connection

there to go to a match, chillin with Leo.

I mean, [00:49:00] yeah, I've been to Rosario, I mean, I know what the old boys was up with that, so, isn't that good though, so. I don't know if

[00:49:09] Dante: Yeah. Mm.

[00:49:11] Chuck: could share a mate. Okay.

[00:49:12] Dante: Yeah. well

[00:49:17] Chuck: Yeah, probably that.

[00:49:18] Robbie: Yeah.

[00:49:19] Chuck: anyway.

[00:49:20] Dante: He speaks no English.

[00:49:22] Chuck: Mmm. Mmm. Not that much. Yeah.

[00:49:26] Robbie: Yeah. Anyway, let's, let's pivot to another question here. If you weren't in tech, what other career would you choose?

[00:49:34] Dante: I'll be a content creator.

[00:49:38] Chuck: Yeah.

[00:49:39] Dante: Yeah, I'm telling you so.

I know tons of

[00:49:44] Chuck: Like

[00:49:45] Dante: Tick tock, tick tock, man. I know tons of content creators are making lots of money from just those content. I'm like, man, I wonder, am I in the wrong career choice? Did I made the wrong career choice or something? Because it's insane. The [00:50:00] amount of money they're making just,

[00:50:01] Chuck: Mmm.

[00:50:02] Dante: but

[00:50:02] Chuck: heh.

[00:50:03] Dante: I don't know.

But that, that would be my career choice if I wasn't. In tech or maybe something that I would do is play basketball. I used to play basketball a lot when I was growing up. So, but I had a lot of injuries, so maybe I would have probably been on the bench like most of 10 hugs team, but yeah. Yeah. Yeah.

[00:50:33] Robbie: I heard of a new career today that I'm interested in. Apparently if you sell private jets, each one you sell, you get like a 300, 000 commission. So I'm like,

[00:50:44] Dante: Okay.

[00:50:45] Robbie: you just have to sell one jet a year.

[00:50:47] Chuck: And you can live a decent

[00:50:49] Robbie: Can I do it? Yeah.

[00:50:50] Dante: Hmm.

[00:50:51] Chuck: You just said you're not

[00:50:52] Dante: a year.

[00:50:54] Robbie: know, so maybe I'm not the best fit, but I mean, like, for people looking for a gig that are decent at [00:51:00] sales, maybe check that out. That sounds like a lucrative

[00:51:02] Chuck: sell private jets, yeah. Cause the rich stay rich and get richer.

[00:51:07] Robbie: Yep.

[00:51:08] Dante: huh, Uhuh. Interesting.

[00:51:10] Robbie: true.

[00:51:11] Chuck: Yeah, you got Dante thinking like, Hmm, could I It's funny, so my context to the name Dante, aside from like Dante's Inferno, which is probably like the frequent thing you get referenced, but have you ever seen the movie Clerks by Kevin Smith? And there's like been three of them or something, but Clerks?

It was a 90's indie film and then he got famous and made a few more amongst many other things,

but

[00:51:39] Robbie: was more than two?

[00:51:40] Chuck: Yeah, there's a third one. I haven't seen the third one. So but you know, because Kevin Smith isn't as famous as he was once with whatever. But I've enjoyed many of his films. Yeah, so in Clerks, the original one, the main character is Dante, who runs

[00:51:58] Dante: Hmm.

[00:51:58] Chuck: convenience store.

And then his [00:52:00] friend Randall runs the video store next, next door. So this, again, I am a Gen X er, so we still had VHS tapes. It's a 90s movie, but yeah, that character Dante. Anyway, I don't know.

[00:52:15] Dante: Hmm. Interesting.

[00:52:16] Chuck: there for me.

[00:52:18] Dante: Yeah, that's nice. That's a new one for me too.

I'm going to say. uh, So,

[00:52:29] Chuck: there's that.

[00:52:31] Robbie: We are about at time here where can people connect with you and find more, find out more about onboard base and you know, whatever you want to plug here at the end.

[00:52:44] Dante: yeah, we are taking beta invites for proxy vault at the moment. Proxy vault is a global permissioning systems for your infrastructure and digital assets. So check it out request any assets and [00:53:00] who are due to the team.

[00:53:01] Chuck: Nice. So you're sending out at

[00:53:03] Robbie: Cool.

[00:53:03] Chuck: additional beta invites, right?

[00:53:06] Dante: Yeah, at least two.

[00:53:08] Chuck: All right. Fair enough.

[00:53:10] Robbie: Yeah.

[00:53:10] Chuck: definitely check out your open source. Mhm.

[00:53:12] Dante: Yeah, thank you. Yeah, yeah.

[00:53:17] Robbie: for listening. If you liked it, please subscribe, leave us some ratings and reviews. We appreciate it. And we will catch you next time.