Secrets Management Best Practices and Tools - RUBY 655

WEBVTT
1
00:00:04.799 --> 00:00:07.480
Hey, folks, welcome back to another episode of the Ruby
2
00:00:07.559 --> 00:00:10.759
Rogues podcast. This week, on our panel we have Valentino Stole.
3
00:00:11.359 --> 00:00:11.519
Hey.
4
00:00:11.599 --> 00:00:15.640
Now, I'm Charles Maxwood from top End Devs and this
5
00:00:15.759 --> 00:00:21.399
week we're here with Brian Valalunga. Now, you are the
6
00:00:21.440 --> 00:00:26.039
CEO and co founder of Doppler, and that's an app
7
00:00:26.079 --> 00:00:30.640
that helps manage secrets. You probably have a better pitch
8
00:00:30.719 --> 00:00:32.840
than that, so I'll let you explain what you do.
9
00:00:33.719 --> 00:00:36.520
Hey all, it's great to be here. Yeah, Doppler is
10
00:00:36.759 --> 00:00:39.880
a secrets manager designed to be your single source treat
11
00:00:39.920 --> 00:00:44.640
for secrets across all your projects, environments, team members, and infrastructure.
12
00:00:45.159 --> 00:00:46.439
So you kind of think about it like as get
13
00:00:46.520 --> 00:00:48.560
up for secrets.
14
00:00:48.039 --> 00:00:52.200
Right, And I think I don't know. In the Ruby
15
00:00:52.200 --> 00:00:55.799
community at least where I deal with people, and especially
16
00:00:55.799 --> 00:00:58.520
in Rails, right, we kind of understand what the secrets are.
17
00:00:58.600 --> 00:01:03.119
It's your password, it's maybe your you know, you have
18
00:01:03.200 --> 00:01:05.319
your Rails master key, which gives you access to the
19
00:01:05.359 --> 00:01:09.719
secrets in Rails, but you also have like your what
20
00:01:09.879 --> 00:01:11.760
is that it's a token for your sessions. I can't
21
00:01:11.799 --> 00:01:15.920
remember what it's called anyway, So you need that secret key,
22
00:01:16.079 --> 00:01:18.719
and yeah, people can compromise your security if you don't
23
00:01:18.719 --> 00:01:25.519
have that secured. Are there things besides like passwords and
24
00:01:25.519 --> 00:01:27.680
API keys that you consider secrets?
25
00:01:28.640 --> 00:01:33.840
Yeah, outside like API keys, like a stripe token, yeahse
26
00:01:33.959 --> 00:01:36.760
rls encryption keys are typically the ones that we see
27
00:01:36.799 --> 00:01:40.280
the most. I also just like have like a general
28
00:01:41.519 --> 00:01:44.319
thought process around this of anything that's configured by the
29
00:01:44.359 --> 00:01:46.519
environment should be treated but as a secret, so it
30
00:01:46.560 --> 00:01:50.159
should be treated like the most sensitive thing. So we
31
00:01:50.239 --> 00:01:53.799
kind of tell all of or we recommend our audience
32
00:01:53.879 --> 00:01:56.920
that you should kind of treat your environment variables and
33
00:01:56.959 --> 00:01:59.120
your secrets all the same. Right, your poored in future
34
00:01:59.120 --> 00:02:01.840
flag should be treated securely as your secrets. That way,
35
00:02:01.879 --> 00:02:04.280
developers don't need to make the choice of is this
36
00:02:04.359 --> 00:02:06.560
secure or is this not? They're always just doing the
37
00:02:06.599 --> 00:02:08.919
secure thing by defaults. And then the trick is just
38
00:02:08.960 --> 00:02:12.400
make that whole workflow and tooling as developer friendly as possible.
39
00:02:12.400 --> 00:02:13.919
So they wanted to go down that.
40
00:02:13.840 --> 00:02:18.319
Path, right, So I'm just going to kind of cover
41
00:02:18.400 --> 00:02:22.520
the basics of how I do this, and then maybe
42
00:02:22.520 --> 00:02:24.000
you can tell us if there are other ways that
43
00:02:24.039 --> 00:02:27.080
you're seeing people do it. But typically these kinds of
44
00:02:27.080 --> 00:02:29.759
things where I see them and I'm sure Valentino is
45
00:02:29.800 --> 00:02:32.199
in kind of the same boat. Is they either show
46
00:02:32.280 --> 00:02:39.000
up in environment variables or they show up in the
47
00:02:39.080 --> 00:02:42.319
rail secrets or and effectively, what it is is it's
48
00:02:42.360 --> 00:02:48.120
a it's an encrypted file and so then the encryption
49
00:02:48.240 --> 00:02:51.360
key is usually put into an environment variable or you know,
50
00:02:52.800 --> 00:02:54.800
passed into the system that you're running it on on
51
00:02:54.840 --> 00:02:57.800
the other end in some way. And lately I've been
52
00:02:57.840 --> 00:03:01.479
doing my deployments with Kamal, which uses stocker, and so
53
00:03:03.120 --> 00:03:05.280
it kind of sets that all up when it sets
54
00:03:05.360 --> 00:03:09.719
up the container. But I've always kind of wondered because
55
00:03:10.000 --> 00:03:12.319
you can ask the system if you can get into it,
56
00:03:12.360 --> 00:03:14.919
what the environment variables are, So I don't even know
57
00:03:14.960 --> 00:03:16.560
if that's the best practice anymore.
58
00:03:18.719 --> 00:03:22.840
Yeah, that's pretty much the two paths that we see.
59
00:03:22.879 --> 00:03:26.560
Either some encrypted file somewhere or it's just struggling available
60
00:03:26.599 --> 00:03:31.199
in the environment. I'm a pretty big fan of if
61
00:03:31.240 --> 00:03:34.879
you're going to do the environment path or injected through
62
00:03:34.919 --> 00:03:37.520
the environment, immediately do a cleanup of the environment before
63
00:03:37.560 --> 00:03:40.680
all your other dependencies get loaded in. So like basically
64
00:03:40.680 --> 00:03:43.919
load those secrets out of the environment, then clean them
65
00:03:43.960 --> 00:03:47.319
up from the environment, then load everything else. That way,
66
00:03:47.360 --> 00:03:49.960
you can't have like a rogue dependency, go and capture
67
00:03:49.960 --> 00:03:53.240
all your secrets and then send it somewhere. The other
68
00:03:53.280 --> 00:03:55.960
path of like using a file that's encrypted, is also
69
00:03:56.000 --> 00:03:58.960
a really good path too, So I think both are
70
00:03:58.960 --> 00:03:59.439
pretty good.
71
00:04:00.560 --> 00:04:02.240
What do you do in Valentino? Is it kind of
72
00:04:02.280 --> 00:04:04.520
the same or Uh?
73
00:04:05.360 --> 00:04:09.400
We use a lot of AWS stuff to handle a
74
00:04:09.439 --> 00:04:10.080
lot of the.
75
00:04:12.080 --> 00:04:13.680
Lot a lot of secrets management.
76
00:04:13.719 --> 00:04:16.800
We have a secret there. Yeah, and then I think
77
00:04:16.839 --> 00:04:20.920
that it may even be isolated from the main environments
78
00:04:20.959 --> 00:04:26.040
too and handled that way in an isolated environment. We
79
00:04:26.199 --> 00:04:28.600
use soccer as well, so it could be like an
80
00:04:28.600 --> 00:04:31.680
isolated container that then feeds back into the other container.
81
00:04:32.360 --> 00:04:35.199
So are you I'm guessing you have your secrets stored
82
00:04:35.240 --> 00:04:38.079
on like a secrets manager, and then those secrets are
83
00:04:38.079 --> 00:04:40.439
then pushed into the container. H.
84
00:04:40.480 --> 00:04:43.319
I think so something like that. Uh, it may even
85
00:04:43.360 --> 00:04:47.839
be one step further where uh it's in a w
86
00:04:48.199 --> 00:04:51.439
S and then at like run time, it's like the
87
00:04:51.480 --> 00:04:55.000
secrets are loaded into the apps memory. Uh for the
88
00:04:55.040 --> 00:04:58.199
particular use case. I don't really know all of the details,
89
00:04:58.240 --> 00:05:01.360
to be honest, I'm not on the infrastructure team. Everyone's
90
00:05:01.360 --> 00:05:05.560
a while. We have to rotate keys and that's definitely, uh,
91
00:05:06.920 --> 00:05:10.959
you know, an easy process for us. But yeah, we
92
00:05:11.000 --> 00:05:12.680
have some command line that does it. It's not just
93
00:05:12.759 --> 00:05:14.920
like changing the environment variable.
94
00:05:16.959 --> 00:05:18.560
Sounds like you guys are pretty well set up there.
95
00:05:18.560 --> 00:05:20.800
I mean that's that's like the dream is to make
96
00:05:21.079 --> 00:05:23.839
secret trans super easy and simple but also very secure
97
00:05:23.839 --> 00:05:24.439
at the same time.
98
00:05:26.240 --> 00:05:30.160
Yeah. That makes me, uh curious because like I think
99
00:05:30.160 --> 00:05:34.319
at one time we were using forget what hash rockets
100
00:05:34.319 --> 00:05:40.160
product is, we ended up moving away from that. Yeah,
101
00:05:40.199 --> 00:05:42.439
I don't know, we were using some vendor for doing
102
00:05:42.439 --> 00:05:46.120
the secret management, but yeah, having a command line or
103
00:05:46.199 --> 00:05:49.879
some kind of central place. Uh, the command line doesn't
104
00:05:49.920 --> 00:05:54.199
even need to be your you know, your ux of choice,
105
00:05:54.240 --> 00:05:57.800
but just having the central lives place where all of
106
00:05:57.800 --> 00:06:02.959
that access points happen. It definitely helps like isolate and
107
00:06:03.120 --> 00:06:06.519
track to be honest, who's touching what and changing it.
108
00:06:08.680 --> 00:06:11.120
I don't know if Doppler has those kind of features
109
00:06:11.160 --> 00:06:14.839
as far as like tracking changes and getting the full
110
00:06:15.040 --> 00:06:19.519
logs and things like that, but that's definitely been super valuable.
111
00:06:20.240 --> 00:06:23.600
Yeah, So I think Doppler kind of comes from a
112
00:06:23.639 --> 00:06:25.639
first principal standpoint about like what is a good secrets
113
00:06:25.680 --> 00:06:27.480
manager look like? And for us, we have a couple
114
00:06:27.519 --> 00:06:30.279
of things that we deeply care about. First is that
115
00:06:30.399 --> 00:06:34.000
all your secrets are centralized in one place across your
116
00:06:34.040 --> 00:06:37.839
projects and environments. And once they're all in one place,
117
00:06:38.000 --> 00:06:40.959
we can set up pretty robust access controls, either by
118
00:06:41.040 --> 00:06:44.639
users or by groups that are policy driven. And then
119
00:06:44.839 --> 00:06:46.759
from there you get a complete audit story, so you
120
00:06:46.800 --> 00:06:49.720
know every time a son's read a secret, written a secret,
121
00:06:49.800 --> 00:06:53.560
change some settings on every device. With the ri ip address,
122
00:06:53.639 --> 00:06:56.720
you get a whole picture about everything that's going around
123
00:06:56.920 --> 00:06:58.920
or going on around your secrets. And then the other
124
00:06:59.000 --> 00:07:01.720
key part is that it's deeply connected to their workflows
125
00:07:01.720 --> 00:07:04.800
and their infrastructure. So on the workflow side, and like
126
00:07:04.879 --> 00:07:07.319
local developments, we want you to be able to edit
127
00:07:07.360 --> 00:07:09.199
your secrets side by side with your code. You have
128
00:07:09.199 --> 00:07:12.879
a vis code extension, and so those secrets actually kind
129
00:07:12.879 --> 00:07:15.199
of look like a Yami file, but they're actually not.
130
00:07:15.399 --> 00:07:19.600
It's like a something called a virtual file system, so
131
00:07:19.759 --> 00:07:21.279
it behaves like a file, but it's actually not as
132
00:07:21.279 --> 00:07:23.920
connecting a dowtware in the back end, so it's super secure.
133
00:07:24.319 --> 00:07:27.879
And then on the orchestration side for production is we
134
00:07:27.920 --> 00:07:30.519
will write into a toa secrets manager into Kubernetes or
135
00:07:30.560 --> 00:07:33.120
wherever it may be, so that your infrastructure immediately gets
136
00:07:33.120 --> 00:07:36.639
those secrets when they change and restart your deployment seed,
137
00:07:36.800 --> 00:07:37.759
you don't have any downtime.
138
00:07:38.600 --> 00:07:40.720
Yeah, I remember using a system like this way back
139
00:07:40.759 --> 00:07:42.240
in the day. I think you had to log into
140
00:07:42.279 --> 00:07:44.839
their interface or use their command line interface in order
141
00:07:44.839 --> 00:07:47.279
to edit your secrets. And I can't, for the life
142
00:07:47.319 --> 00:07:51.600
of me remember what it was called. But I played
143
00:07:51.600 --> 00:07:54.319
with it and it was cool. It was just there
144
00:07:54.600 --> 00:07:57.839
were steps to setting it up, and I'm lazy, and
145
00:07:57.920 --> 00:07:59.600
so I just went back to what I was doing.
146
00:08:00.519 --> 00:08:03.519
I for that matter, you got to make it Like
147
00:08:03.560 --> 00:08:06.000
we have this theme at Doppler, and it's it's quite simple.
148
00:08:06.000 --> 00:08:09.000
It's make vegetables taste like candy, vegetables being the security
149
00:08:09.120 --> 00:08:10.879
candy be in the developer productivity. If you do not
150
00:08:11.079 --> 00:08:13.600
make it, if the tool does not make the developers'
151
00:08:13.600 --> 00:08:15.560
lives better, Like you can't just say, hey, use this
152
00:08:15.600 --> 00:08:18.240
tool because it's more secure, like that doesn't fly, because
153
00:08:18.240 --> 00:08:20.920
developers then they care about moving fast and shipping product,
154
00:08:21.120 --> 00:08:23.079
and so you have to aid them in that you have,
155
00:08:23.199 --> 00:08:24.560
Like in our case, we try to give them two
156
00:08:24.600 --> 00:08:26.839
hours a day or sorry, two hours a week. Back
157
00:08:27.000 --> 00:08:30.399
in productivity. And so if you if you do that,
158
00:08:30.439 --> 00:08:31.920
if you give them good candy, then you'll get the
159
00:08:32.000 --> 00:08:32.639
vegetables too.
160
00:08:33.759 --> 00:08:37.840
Yeah, that makes sense. I kind of want to dive
161
00:08:37.840 --> 00:08:41.320
in a little bit more on just why we protect
162
00:08:41.320 --> 00:08:46.159
the secrets because I think we all kind of intellectually know,
163
00:08:47.120 --> 00:08:50.159
but I don't know. When I get into stuff and
164
00:08:50.200 --> 00:08:52.879
I start, you know, dealing with the secrets, it's like, oh,
165
00:08:53.000 --> 00:08:55.360
somebody got access to my like my stripe tokens. I
166
00:08:55.360 --> 00:08:57.840
mean that could be really really bad.
167
00:08:58.039 --> 00:09:01.960
It's really bad. So I like to kind of bucket
168
00:09:01.960 --> 00:09:06.120
the risk in sorry, yeah, bucket the risk into two buckets.
169
00:09:06.519 --> 00:09:08.159
The first is like the risk of the company and
170
00:09:08.200 --> 00:09:10.600
the second is the risk to people. And I think
171
00:09:10.600 --> 00:09:13.159
the company side is like pretty well understood, right, You're
172
00:09:13.159 --> 00:09:14.759
gonna have a pretty if you have a data breach,
173
00:09:14.799 --> 00:09:18.159
you're gonna have a pretty big brand hits and trust hits.
174
00:09:18.440 --> 00:09:21.480
You're gonna probably have some unexpected spend because now you're
175
00:09:21.480 --> 00:09:25.919
investing in like legal pr insurance, you may get sued
176
00:09:25.960 --> 00:09:28.120
as well, because if you're not managing your secrets, and
177
00:09:28.120 --> 00:09:29.759
the secrets are things that get leaked that leads to
178
00:09:29.759 --> 00:09:32.799
a data breach. That's just straight up negligence, and you're
179
00:09:33.240 --> 00:09:36.039
the customers are right or in their rights to sue.
180
00:09:36.200 --> 00:09:38.320
But I think the thing that's most of the time
181
00:09:38.399 --> 00:09:40.279
not talked about is like the cost to real people
182
00:09:40.639 --> 00:09:42.919
at the end day, all these companies that we use
183
00:09:43.039 --> 00:09:44.960
were trusting them to store our data and keep our
184
00:09:45.000 --> 00:09:48.039
private data private. Imagine if like every YouTube video that
185
00:09:48.080 --> 00:09:50.879
you ever saw got out, or every ride you ever
186
00:09:50.919 --> 00:09:52.799
took on an uber, every transaction you ever made on
187
00:09:52.799 --> 00:09:55.480
a credit card all got out, and actually have a
188
00:09:55.480 --> 00:09:59.080
real personal story of like how this has impacted me. Sadly,
189
00:09:59.159 --> 00:10:01.080
I've been part of a couple of data breaches now
190
00:10:01.120 --> 00:10:04.919
from some of the services I've used, and that came
191
00:10:04.960 --> 00:10:08.480
back and really bit me in an interesting way. I
192
00:10:08.639 --> 00:10:10.480
was so I just moved to Austin, Texas a couple
193
00:10:10.519 --> 00:10:14.120
of months ago and from California, and I convinced my
194
00:10:14.159 --> 00:10:16.840
mom to fly out with me and see Austin for itself.
195
00:10:16.879 --> 00:10:19.279
When we were at this barbecue joint and while we're
196
00:10:19.320 --> 00:10:23.039
eating food, I get a call from the Texas Customs
197
00:10:23.039 --> 00:10:26.279
and Borders and they say, hey, we found a packaging
198
00:10:26.320 --> 00:10:29.120
your name that has illegal money and drugs in it,
199
00:10:29.519 --> 00:10:32.720
and we're federally investigating you now. And this is like
200
00:10:32.759 --> 00:10:34.200
the phone call for me where I was like, oh shit,
201
00:10:34.279 --> 00:10:37.480
my life has just ended like from the high really
202
00:10:37.480 --> 00:10:42.120
really quickly, and I was really scared, but like also
203
00:10:42.200 --> 00:10:45.600
kind of like this is odd, like never bought anything
204
00:10:45.600 --> 00:10:50.960
from Mexico before, so like okay, and the back of
205
00:10:50.960 --> 00:10:52.679
my head, I was like, this is a scam, probably,
206
00:10:52.919 --> 00:10:55.480
But then they started rattling off all this information about
207
00:10:55.480 --> 00:10:57.360
me that they knew all the places I'd lived in
208
00:10:57.399 --> 00:11:00.960
the past, locations I had been to, like just so
209
00:11:01.440 --> 00:11:04.000
like a wealth of information about me that I was like,
210
00:11:04.240 --> 00:11:08.080
no one could possibly know this but the government, and
211
00:11:08.120 --> 00:11:10.000
so like I trusted them. I was like, okay, I'm
212
00:11:10.000 --> 00:11:14.000
actually being investigated here. And obviously we get lawyers on
213
00:11:14.039 --> 00:11:16.080
the call as well, like this becomes a really scary
214
00:11:16.639 --> 00:11:19.039
ordeal for all of us. And it wasn't until about
215
00:11:19.080 --> 00:11:22.639
like an hour in that our lawyers picked up that
216
00:11:22.759 --> 00:11:27.000
it wasn't that it was a scam. And but during
217
00:11:27.039 --> 00:11:28.639
that hour we also gave them a whole lot more
218
00:11:28.639 --> 00:11:30.919
information about me, right because we thought we would be
219
00:11:30.919 --> 00:11:33.320
investigated and they were asking questions and so like this
220
00:11:33.360 --> 00:11:36.919
is and like again I'm a CEO of a cybersecurity company.
221
00:11:37.000 --> 00:11:38.960
I'm trained on this, our employees are trained on this,
222
00:11:39.000 --> 00:11:40.720
our legal team is trained on this, and they still
223
00:11:40.720 --> 00:11:43.600
got us for an hour, Right. I can imagine every
224
00:11:43.679 --> 00:11:47.960
day Joe who's not trained could really get it attacked here.
225
00:11:47.960 --> 00:11:49.480
And like, I was lucky that all they do is
226
00:11:49.480 --> 00:11:51.399
get a little bit more information about us. But they
227
00:11:51.399 --> 00:11:53.360
were able to get that information because of other information
228
00:11:53.399 --> 00:11:56.440
that got breached, right, that bought them the credibility to
229
00:11:56.440 --> 00:11:59.360
get new information. But imagine like my mom, my sister,
230
00:11:59.480 --> 00:12:01.360
or anyone all like that who's not gone through any
231
00:12:01.360 --> 00:12:04.360
of that training, does not have legal counsel immediately readily
232
00:12:04.360 --> 00:12:06.240
available to them that can jump on the call for this.
233
00:12:06.559 --> 00:12:08.559
Oh my gosh, I cannot imagine all the information that
234
00:12:08.600 --> 00:12:09.879
I've been given up and all of a sudden, their
235
00:12:09.919 --> 00:12:13.600
bank counts are drained or the credit score is completely ruined,
236
00:12:13.879 --> 00:12:16.600
or whatever it may be. It can get really terrifying,
237
00:12:16.679 --> 00:12:18.840
really fast. And that's why I come back to Like
238
00:12:19.000 --> 00:12:20.759
whenever I see like a data region, it's like X
239
00:12:20.840 --> 00:12:23.879
millions of people's data was just got out. It's like wow,
240
00:12:24.120 --> 00:12:26.440
Like scammers are now like parading in the streets going like,
241
00:12:26.480 --> 00:12:28.279
oh my gosh, I've just got a ton of data
242
00:12:28.320 --> 00:12:29.679
that's going to get me so much more data that
243
00:12:29.679 --> 00:12:31.879
can eventually get me to like the jackput of all
244
00:12:31.879 --> 00:12:34.840
this money or whatever they're trying to go after. And
245
00:12:34.919 --> 00:12:37.399
so there's real people's lives, including mine, that have been
246
00:12:37.399 --> 00:12:39.720
impacted by this, and that is something that's like often
247
00:12:40.039 --> 00:12:42.120
not talked about at all. And so when you're a
248
00:12:42.120 --> 00:12:44.559
developer and you're like, ah, should I put this in
249
00:12:44.600 --> 00:12:46.159
a new follow or not? Or should I secure my
250
00:12:46.200 --> 00:12:48.679
secrets just one token, it's it's just a string. It's like, well,
251
00:12:48.879 --> 00:12:52.159
that string may impact a million people's lives someday, so
252
00:12:52.399 --> 00:12:53.039
to treat.
253
00:12:52.879 --> 00:12:58.360
Right right, Well, it reminds me your story a little
254
00:12:58.399 --> 00:13:01.399
bit of if you're a ghost the Wires, is it?
255
00:13:01.480 --> 00:13:03.639
Kevin Mitnick, Yeah, Kevin Minnick.
256
00:13:03.679 --> 00:13:06.200
Yeah, I've watched the movie about him. I haven't read the.
257
00:13:06.120 --> 00:13:08.399
Book, and see I didn't know there was a movie,
258
00:13:08.399 --> 00:13:11.840
but I read the book. But yeah, he talks about
259
00:13:11.879 --> 00:13:15.279
how effectively, yeah, he gets just a little bit of
260
00:13:15.360 --> 00:13:18.399
information about the next person in the chain, right, and
261
00:13:18.480 --> 00:13:23.039
so he doesn't start with the analyst or whoever, right,
262
00:13:23.519 --> 00:13:29.600
he starts with you know, the low down person on
263
00:13:29.639 --> 00:13:33.360
the totem pole. And then you know, gets enough information
264
00:13:33.399 --> 00:13:35.120
to know who the next person is and then works
265
00:13:35.159 --> 00:13:39.600
his way up and so it's yeah, it was a
266
00:13:39.639 --> 00:13:44.879
fascinating read just from the sense of yeah, you know,
267
00:13:45.559 --> 00:13:49.639
just just anyway. So yeah, so I can definitely see that.
268
00:13:52.200 --> 00:13:54.000
I think. The other thing that I worry about is
269
00:13:54.080 --> 00:13:56.279
like if I have a key to I don't know,
270
00:13:56.360 --> 00:13:59.399
like chat, GPT or something like that, somebody could run
271
00:13:59.480 --> 00:14:02.320
up my bill yep, or you know, somebody gets in
272
00:14:02.519 --> 00:14:06.320
my hosting account and you know, all of a sudden,
273
00:14:06.360 --> 00:14:09.559
I've got you know, they they breach my other stuff
274
00:14:09.600 --> 00:14:13.279
that way, and anyway.
275
00:14:13.720 --> 00:14:15.440
No, I think you're totally right. I mean, there's two
276
00:14:15.440 --> 00:14:17.960
common things that we see all the time. One is
277
00:14:18.080 --> 00:14:21.039
like some source code goes public or some email gets
278
00:14:21.120 --> 00:14:22.519
leaked and that has a secret in itto like an
279
00:14:22.559 --> 00:14:25.240
AWS account, and you'll see one of two things happen immediately.
280
00:14:25.519 --> 00:14:28.320
The first is their bill just like skyrockets in seconds
281
00:14:28.559 --> 00:14:32.679
because now they're using AWS for some other bought attack
282
00:14:32.960 --> 00:14:36.360
or for mining crypto or whatever may. That happens very
283
00:14:36.440 --> 00:14:39.720
very commonly, and it's surprisingly like how fast that that
284
00:14:39.840 --> 00:14:42.039
like that those secrets get found, Like I think there
285
00:14:42.080 --> 00:14:43.559
was like an average set that it's like within three
286
00:14:43.559 --> 00:14:46.120
to five seconds of like a rebook going public if
287
00:14:46.120 --> 00:14:48.679
it has a secret, and even in the history, it
288
00:14:48.720 --> 00:14:51.440
will get found and start getting exploited. So it's like
289
00:14:51.639 --> 00:14:56.200
very like it's it's it's it's insanely quick. And then
290
00:14:56.840 --> 00:14:58.320
the other side of it is now that they have
291
00:14:58.360 --> 00:15:01.519
access to AABS, they can start scanning all your resources. Okay,
292
00:15:01.600 --> 00:15:05.320
what execution environments are set up, what databases are set up?
293
00:15:05.320 --> 00:15:07.240
Can I get access to those database? How privileged to
294
00:15:07.240 --> 00:15:10.039
is this credential? And you start having this ripple fact
295
00:15:10.039 --> 00:15:12.279
where it's like, oh my gosh. Now, especially if it
296
00:15:12.320 --> 00:15:15.039
as like like strong super admin permissions, it can start
297
00:15:15.039 --> 00:15:17.279
creating other credentials. And now you have this like canon
298
00:15:17.279 --> 00:15:18.480
mouse game of like how do I get out of
299
00:15:18.480 --> 00:15:20.000
the system? Could have locked me out of the system?
300
00:15:21.840 --> 00:15:23.559
Are their back doors it's placing in so even if
301
00:15:23.559 --> 00:15:26.159
we remove it's still actually there. Like it gets scared
302
00:15:26.240 --> 00:15:28.200
really quickly. Once they get into the system, it's very
303
00:15:28.279 --> 00:15:29.120
very hard to get them out.
304
00:15:29.279 --> 00:15:32.679
Yeah, this always makes me wonder like because there's two
305
00:15:32.720 --> 00:15:35.320
parts of this, right, Like we have the secrets and
306
00:15:35.320 --> 00:15:38.639
then there's like the whole encryption aspect of it, which
307
00:15:38.679 --> 00:15:40.360
is on separate piece of the.
308
00:15:40.360 --> 00:15:44.360
Discussion when you say the encryption aspect of it, is
309
00:15:44.360 --> 00:15:46.480
that like how you're securing your secrets or is that
310
00:15:46.559 --> 00:15:47.519
like encryption keys.
311
00:15:47.519 --> 00:15:49.879
Well, you're I mean, ultimately, what you're using a lot
312
00:15:49.919 --> 00:15:53.080
of the secrets for I would imagine is to encrypt
313
00:15:53.200 --> 00:15:58.000
something or even to Yeah, I mean to encrypt stuff.
314
00:15:59.320 --> 00:16:01.960
You're either hiding stuff or accessing stuff is usually what
315
00:16:02.000 --> 00:16:02.440
you're doing.
316
00:16:02.840 --> 00:16:04.840
Based on the data that we have from Doppler, we
317
00:16:04.879 --> 00:16:08.159
can't see customer secrets at all, but we can get
318
00:16:08.159 --> 00:16:10.120
an auto report of the names of the secrets they
319
00:16:10.200 --> 00:16:14.000
use if they give a set permission, and from the
320
00:16:14.080 --> 00:16:17.679
data we have, it's like ninety percent of the of
321
00:16:17.840 --> 00:16:21.159
the sensitive secrets that we put in Doppler and customers
322
00:16:21.200 --> 00:16:23.320
evan ability say this is sensitive or this is not
323
00:16:24.759 --> 00:16:27.279
is actually like access token, so it's not encryption tokens.
324
00:16:27.919 --> 00:16:29.519
So it's like if you get that stripe key, you
325
00:16:29.519 --> 00:16:31.600
have it all, like you have every customer's CARDIT card
326
00:16:31.600 --> 00:16:34.480
and bank counter. Yeah in there, there's no extra layer
327
00:16:34.519 --> 00:16:34.960
of protection.
328
00:16:37.840 --> 00:16:42.320
Yeah, that's all. I always want to One of the
329
00:16:42.320 --> 00:16:45.360
the biggest things that I always hope for when I'm
330
00:16:45.480 --> 00:16:49.039
like getting a new vendor, like access token or whatever
331
00:16:49.080 --> 00:16:51.519
it may be, is that they like have some kind
332
00:16:51.519 --> 00:16:55.840
of like you know, white list stability with like either
333
00:16:55.879 --> 00:16:59.279
their domain like a domain key, or some kind of
334
00:16:59.320 --> 00:17:04.559
identify that can be like uh, you know, securely matched
335
00:17:04.920 --> 00:17:09.000
when the handshake is made using their service from whatever
336
00:17:09.039 --> 00:17:13.759
server that you're end up using. And it's in my
337
00:17:13.839 --> 00:17:17.680
experience like that it's very honestly very rare, yes, that
338
00:17:17.880 --> 00:17:21.680
that actually happens. And so I under that makes a
339
00:17:21.720 --> 00:17:23.640
lot of sense to you saying that your customer is
340
00:17:23.720 --> 00:17:27.799
like mostly store like access tokens, because most vendors don't
341
00:17:28.039 --> 00:17:31.720
give you that like white listability and like handshake process,
342
00:17:31.799 --> 00:17:35.799
which is like very important, right, I think causes a
343
00:17:35.799 --> 00:17:37.279
lot of the breaches when it's not there.
344
00:17:38.759 --> 00:17:41.079
Agreed. I do think that the world is changing, it's
345
00:17:41.079 --> 00:17:43.160
just gonna be very very slow. So like you can
346
00:17:43.200 --> 00:17:46.279
see this in passwords today, where we're going from passwords
347
00:17:46.279 --> 00:17:49.759
to pass keys, so anyone familiar past caise. It's basically
348
00:17:49.759 --> 00:17:51.599
like you can sign into a website with like your
349
00:17:51.599 --> 00:17:54.960
face or touch id and you never had to put
350
00:17:54.960 --> 00:17:57.200
in a password. It's a password passwordless world. And the
351
00:17:57.240 --> 00:17:59.799
way that's working is for cryptography, you have like a
352
00:17:59.799 --> 00:18:02.799
fing a print that leads to a cryptographic signature that
353
00:18:02.839 --> 00:18:06.799
can be used authenticate yourself. And that thing that's happening
354
00:18:06.839 --> 00:18:08.920
in passwords is now starting to happen in secrets with
355
00:18:09.000 --> 00:18:11.799
identity based authentication. And so like the kind of picture
356
00:18:11.839 --> 00:18:14.880
that we can start to see happening very very slowly
357
00:18:14.960 --> 00:18:17.440
in like Doppler's job is to help move this along,
358
00:18:18.200 --> 00:18:21.200
help move the industry along, is to have like this
359
00:18:21.319 --> 00:18:23.359
bridge of connection. So like on one side, you have
360
00:18:23.519 --> 00:18:28.559
like your AWS GCP execution environment and that has an
361
00:18:28.599 --> 00:18:31.799
identity already today, and then you compare that with Doppler,
362
00:18:32.240 --> 00:18:34.359
and now you're authentic by the fact that you're in
363
00:18:34.400 --> 00:18:37.400
that easy two instance or you are now automatically authenticated
364
00:18:37.440 --> 00:18:40.000
to Doppler, and then eventually Doppler will have the connection
365
00:18:40.079 --> 00:18:43.039
of now that you're authenticated with Doppler, you're automatically authenticated
366
00:18:43.079 --> 00:18:45.799
to Stripe. There's no more apike needed. We are all
367
00:18:45.799 --> 00:18:49.839
cryptographically authorizing each other process chain or this high way
368
00:18:49.880 --> 00:18:52.839
of authentication. And that's kind of like the dream state
369
00:18:52.839 --> 00:18:54.400
that we're going to be getting to over the next
370
00:18:54.480 --> 00:18:56.160
couple of years. It's going to take a lot of
371
00:18:56.200 --> 00:18:57.559
work of working with partners because now they have to
372
00:18:57.599 --> 00:19:00.880
commit strike Twilio and so many other providers to enable this,
373
00:19:01.000 --> 00:19:03.000
and we're gonna try to make diseases possible, but it's
374
00:19:03.000 --> 00:19:05.400
gonna be it's gonna be an alcohol battle. But if
375
00:19:05.440 --> 00:19:07.319
we can do that, we're a secretless work.
376
00:19:07.759 --> 00:19:10.960
Is there an open standard that is following this process
377
00:19:11.039 --> 00:19:11.279
or no?
378
00:19:12.160 --> 00:19:15.480
There is a little bit of an open standards mostly
379
00:19:15.519 --> 00:19:18.200
between like a WUS and X like Doppler or whatever
380
00:19:18.279 --> 00:19:21.279
may be, but there's no open standard on or even
381
00:19:21.319 --> 00:19:26.720
a standard altogether on the like secrets Manager to third
382
00:19:26.720 --> 00:19:30.279
party service, x Stripe, Petulio. So I think our goal
383
00:19:30.440 --> 00:19:32.200
is we're going to probably try to create an open
384
00:19:32.200 --> 00:19:35.480
standard that both sides adhere to so that if you're
385
00:19:35.480 --> 00:19:38.440
anywhere in this chain you can directly you can just
386
00:19:38.680 --> 00:19:40.680
plug in very quickly. And I think we'll probably have
387
00:19:40.759 --> 00:19:44.200
to build SDKs for like every primary language and Kubernetes
388
00:19:44.200 --> 00:19:46.759
and a bunch of other infrastructure toolings who also just
389
00:19:46.759 --> 00:19:47.720
like work set up the box.
390
00:19:49.480 --> 00:19:53.480
So, I mean, I I find this all really fascinating,
391
00:19:54.599 --> 00:19:59.480
But I guess my question is what kinds of mistakes
392
00:19:59.519 --> 00:20:02.599
might I be now or you know, what kinds of
393
00:20:02.640 --> 00:20:05.240
things should I be considering doing now to protect these
394
00:20:05.240 --> 00:20:09.720
secrets because yeah, you know, what you're talking about sounds brilliant,
395
00:20:09.759 --> 00:20:12.880
but it doesn't exist yet. Yeah, I'm just I'm a
396
00:20:12.920 --> 00:20:15.240
little worried that. Okay, we're going to talk the rest
397
00:20:15.279 --> 00:20:17.559
of this time about futuristic stuff, and then I'm gonna
398
00:20:17.599 --> 00:20:19.519
be Yeah, I'm gonna miss something.
399
00:20:20.039 --> 00:20:22.759
All right. So I have four questions that I think
400
00:20:22.839 --> 00:20:26.079
every person listening should ask themselves. And it's like basically
401
00:20:26.160 --> 00:20:27.920
a very simple sniff test to see if I have
402
00:20:27.960 --> 00:20:31.279
a problem. So to highlight what the problem is, it's
403
00:20:31.319 --> 00:20:34.079
called secret sprawl, and that is basically, all your secrets
404
00:20:34.119 --> 00:20:36.920
are scattered across a bunch of different places, and because
405
00:20:36.920 --> 00:20:38.480
of that, you have no way of controlling and or
406
00:20:38.519 --> 00:20:40.799
governing it, which is like one of the most important
407
00:20:40.799 --> 00:20:42.519
parts about protecting your secrets is being one of govern
408
00:20:42.559 --> 00:20:45.839
those secrets. And so the four questions are, can you
409
00:20:45.880 --> 00:20:50.079
confidently answer where are all my secrets? Right? Not just
410
00:20:50.119 --> 00:20:53.039
the ones that you know about him and secrets manager somewhere,
411
00:20:53.039 --> 00:20:55.440
but all the ones on developers, laptops, all the ones
412
00:20:55.480 --> 00:20:59.680
in slack and email, in your code somewhere, Like you
413
00:20:59.720 --> 00:21:01.799
gotta have a complete picture where all your secrets are.
414
00:21:01.839 --> 00:21:03.400
And you got to be able to make that guarantee
415
00:21:03.559 --> 00:21:06.039
that you're not going to miss one by not knowing
416
00:21:06.119 --> 00:21:08.920
about it, And I'll talk about how to solve that
417
00:21:08.960 --> 00:21:11.960
in a second. The second is do you know who
418
00:21:12.000 --> 00:21:15.000
has access to all of those secrets? And this gets
419
00:21:15.039 --> 00:21:17.279
really scary, especially if you don't have like a centralized system,
420
00:21:17.319 --> 00:21:18.480
because like, if I have a file, I can to
421
00:21:18.480 --> 00:21:20.160
share it to another person and no one on the
422
00:21:20.160 --> 00:21:24.000
scary team is going to know about that. Can I
423
00:21:24.039 --> 00:21:28.079
control who has accessed those secrets, when they were accessed
424
00:21:28.799 --> 00:21:32.440
and by who? Right? So, do I have access controls?
425
00:21:32.480 --> 00:21:35.640
And do I have an autolog associated with those access events?
426
00:21:36.920 --> 00:21:39.079
And then, most importantly, when a data breach does happen,
427
00:21:39.079 --> 00:21:41.599
can I stop it very very quickly? When I say quickly,
428
00:21:41.640 --> 00:21:43.519
I mean in the orders of seconds and minutes, not
429
00:21:43.720 --> 00:21:48.400
in the order of days, in weeks or months. And
430
00:21:48.480 --> 00:21:53.279
so if you cannot answer those four questions confidently, like
431
00:21:53.519 --> 00:21:54.680
to the point where your job would be on the
432
00:21:54.680 --> 00:21:56.400
line for it, because it essentially is on the line
433
00:21:56.440 --> 00:22:00.240
for it, then you have a problem. And I can
434
00:22:00.279 --> 00:22:01.559
talk about it in a second what it looks like
435
00:22:01.599 --> 00:22:03.279
to have a solution there. I don't have to go
436
00:22:03.279 --> 00:22:05.039
into like Dopper's features, but I can talk about like
437
00:22:05.279 --> 00:22:07.240
the fundamental properties you'd want to look for in any
438
00:22:07.279 --> 00:22:09.720
secrets manager, Doppler or someone else.
439
00:22:12.359 --> 00:22:16.440
Yeah, I think that's important. It's funny because so I
440
00:22:16.519 --> 00:22:18.319
kind of have two levels of this, one where I'm
441
00:22:18.359 --> 00:22:20.119
working for a client and the other one where I'm
442
00:22:20.160 --> 00:22:23.160
just working on my own stuff. And on my own stuff.
443
00:22:23.160 --> 00:22:25.880
I'm fairly confident that I can answer these questions because
444
00:22:27.240 --> 00:22:30.279
I'm basically the only person accessing or using them. But
445
00:22:32.359 --> 00:22:35.279
then the question for me becomes, Okay, well, how do
446
00:22:35.359 --> 00:22:38.079
I you know, let's say I bring in another developer,
447
00:22:38.119 --> 00:22:41.640
how do I make sure that I know the answers
448
00:22:41.640 --> 00:22:45.640
to those questions? Is I bring them on board?
449
00:22:46.359 --> 00:22:49.799
Yep? And I think once your surface area grows of
450
00:22:50.640 --> 00:22:57.279
team members, infrastructure devices, it gets pretty hard to answer
451
00:22:57.319 --> 00:23:00.799
those questions confidently unless you have a CAD system for it.
452
00:23:02.119 --> 00:23:03.880
So maybe valuable to go into like what actually does
453
00:23:03.920 --> 00:23:07.319
a dedicated solution look like? The first thing is you
454
00:23:07.319 --> 00:23:09.759
can centralize all your secrets in it. So once you
455
00:23:09.759 --> 00:23:11.279
know where all your secrets are and you can confidently
456
00:23:11.319 --> 00:23:12.759
say this is the place we're doing, We're not going
457
00:23:12.839 --> 00:23:14.319
to start our secrets to code we're not going to
458
00:23:14.359 --> 00:23:16.759
send it over email or Slack or Microsoft teams or whatever.
459
00:23:16.799 --> 00:23:18.559
Maybe this is the one place you can get all
460
00:23:18.599 --> 00:23:21.519
your secrets. Now you have a complete landscape of your secrets.
461
00:23:21.839 --> 00:23:23.079
The next thing you should be able to do in
462
00:23:23.079 --> 00:23:26.599
this system is you should be able to can set
463
00:23:26.640 --> 00:23:29.119
up access controls and audit logs around them, so you
464
00:23:29.160 --> 00:23:32.799
can say you have this developed full stack. Developers have
465
00:23:32.839 --> 00:23:35.119
access to the development environment for these sets of projects
466
00:23:35.119 --> 00:23:37.480
for the teams are on, but the DevOps team has
467
00:23:37.519 --> 00:23:40.319
access to production, so you can start gating access and
468
00:23:40.359 --> 00:23:42.680
you have a full audit picture of it. And obviously
469
00:23:42.720 --> 00:23:45.119
that audit picture then gets pushed into your auditing tools
470
00:23:45.160 --> 00:23:50.799
like data Dogs, Simal, Logic, Amazon wherever. Maybe you should
471
00:23:50.799 --> 00:23:53.720
be able to have this infrastructure natively integrated with their
472
00:23:53.759 --> 00:23:56.920
developer workflows for local development. That way, developers aren't working
473
00:23:56.920 --> 00:24:01.000
around the system and then recreating that trying to avoid
474
00:24:01.599 --> 00:24:04.119
and it should be natively integrated with with your production
475
00:24:04.240 --> 00:24:06.720
and staging infrastructure. So that's when it is time to
476
00:24:06.799 --> 00:24:08.440
roll out a secret. You don't have this race condition
477
00:24:08.480 --> 00:24:11.559
of the code arriving before the secrets. Do the secrets
478
00:24:11.599 --> 00:24:13.119
have to arrive first? If the code is going to
479
00:24:13.160 --> 00:24:16.720
rely on those secrets, and so then this kind of
480
00:24:16.720 --> 00:24:18.240
gives you this whole picture. If I know that if
481
00:24:18.279 --> 00:24:20.839
I can see the secrets in this project in this
482
00:24:20.960 --> 00:24:24.640
environment on the solution like the Secrets Manager, then it's
483
00:24:24.640 --> 00:24:27.640
guaranteed in my production infrastructure, or it's guaranteed on my
484
00:24:27.799 --> 00:24:32.039
developer's laptops in a secure way. And that basically gives
485
00:24:32.039 --> 00:24:34.359
you the ability to remediate secrets pretty quickly. And so
486
00:24:34.640 --> 00:24:37.079
the last part of this puzzle is being able to
487
00:24:37.160 --> 00:24:40.359
rotate secrets. Rotation is the fancy way of saying, I'm
488
00:24:40.359 --> 00:24:43.000
going to swap out the locks on the door, and
489
00:24:43.079 --> 00:24:44.440
you got to do it in a way because if
490
00:24:44.440 --> 00:24:47.279
you just like immediately destroy the lock in this case,
491
00:24:47.279 --> 00:24:48.759
you'll just bring yourself down in production. So you have
492
00:24:48.799 --> 00:24:50.279
to do it in a way that does not create
493
00:24:50.319 --> 00:24:53.559
any downtime. And it's usually requiring a two key system.
494
00:24:53.680 --> 00:24:57.279
So like in a database, for example, you don't ever
495
00:24:57.359 --> 00:24:58.759
want to not be able to connect to the database.
496
00:24:58.799 --> 00:25:01.799
So you'd have two credentials to the database and you
497
00:25:01.880 --> 00:25:04.000
swap them and then you rotate one and then you
498
00:25:04.039 --> 00:25:06.960
swap again. And so you want a system that does
499
00:25:07.000 --> 00:25:08.440
all that that should not be done by humans that
500
00:25:08.440 --> 00:25:10.799
should be done by a system that's running on a schedule,
501
00:25:10.960 --> 00:25:13.480
where you have an immediate like I'm fucked button, I
502
00:25:13.480 --> 00:25:14.920
need to click this thing to get me out of
503
00:25:15.319 --> 00:25:17.920
a data breach. And then obviously it orchestrates to the
504
00:25:17.960 --> 00:25:20.160
rest of your infrastructure. And so those are the things
505
00:25:20.160 --> 00:25:22.519
that you should be looking for in a developer, for
506
00:25:22.519 --> 00:25:23.400
a secrets manager.
507
00:25:24.000 --> 00:25:26.920
So I love this. You have this great secret sprawl
508
00:25:27.039 --> 00:25:31.160
page on Doppler I link to and it's really great.
509
00:25:31.720 --> 00:25:36.160
Kind of helps you quickly assess your risk exposure based
510
00:25:36.160 --> 00:25:38.759
on your team size. You go through kind of like
511
00:25:38.799 --> 00:25:42.240
a quick calculation, Oh, we have like this number of projects,
512
00:25:42.720 --> 00:25:46.000
estimate number of secrets per project. Then you have a
513
00:25:46.000 --> 00:25:49.079
certain number of environments, right, so it's a multiplier, and
514
00:25:49.119 --> 00:25:51.519
then you have a multiplayer over the number of team
515
00:25:51.559 --> 00:25:54.799
members too, and so those quickly add up and you
516
00:25:54.920 --> 00:25:57.640
make a great point like you know, the malicious actor,
517
00:25:57.640 --> 00:26:00.759
they only need they need one right of the that
518
00:26:00.759 --> 00:26:06.240
that adds up to uh, And so I'm curious, like, uh,
519
00:26:06.720 --> 00:26:09.319
you know from the from the like the whole point
520
00:26:09.480 --> 00:26:12.559
kind of is like risk assessment and remediation, right, and
521
00:26:12.640 --> 00:26:18.720
like do you find that uh, focusing on that risk
522
00:26:18.880 --> 00:26:21.960
aspect is just as important as like kind of the
523
00:26:22.039 --> 00:26:24.759
secret storage management mechanisms.
524
00:26:25.880 --> 00:26:28.319
Yeah, they go in hand in hand. For sure. You
525
00:26:28.400 --> 00:26:30.240
need something that developers are gonna want to use, that
526
00:26:30.319 --> 00:26:32.279
is secure when they do use it, and you want
527
00:26:32.279 --> 00:26:35.319
to think about that risk like a good a good
528
00:26:35.319 --> 00:26:37.079
way that I kind of like talk about it when
529
00:26:37.079 --> 00:26:39.640
I'm talking Turnal with their employees. The game of offense
530
00:26:39.680 --> 00:26:42.839
and defense are very different games. The game of defense
531
00:26:43.079 --> 00:26:46.440
is build walls around your perimeter as high as possible,
532
00:26:46.440 --> 00:26:50.240
as strong as possible, no uh no cracks in the foundation, right,
533
00:26:50.799 --> 00:26:53.319
And then the goal of offense of a of an attacker,
534
00:26:53.359 --> 00:26:55.599
of a hack of a hacker is to find one
535
00:26:55.680 --> 00:26:57.559
crack in the foundation and hit it as hard as
536
00:26:57.559 --> 00:27:00.880
fricking possible. That brings brings down the entire wall. Right,
537
00:27:01.119 --> 00:27:04.400
they only need one week link, and if secrets having
538
00:27:04.400 --> 00:27:06.240
to be that week link, well then you're really giving
539
00:27:06.240 --> 00:27:09.480
them the keys to your digital kingdom. That's extra bad.
540
00:27:09.640 --> 00:27:11.960
I'd much rather be the weak link be something far
541
00:27:12.160 --> 00:27:16.359
outer in the perimeter, like I don't know, some authentication
542
00:27:16.400 --> 00:27:18.359
bug or something like that that that impacts like one
543
00:27:18.480 --> 00:27:22.720
or two users, not your entire users user base, And
544
00:27:22.799 --> 00:27:27.200
so Uh, yeah, managing risk is incredibly more near. That's
545
00:27:27.240 --> 00:27:29.079
that's the end goal that you're trying to accomplish is
546
00:27:29.119 --> 00:27:31.599
like make sure you can stay up and orchestrate like that,
547
00:27:31.799 --> 00:27:34.079
get get all the DevOps and platform tooling you're looking for,
548
00:27:34.839 --> 00:27:37.000
and then also manage the risk associated with that.
549
00:27:38.599 --> 00:27:41.759
So I'm curious, like if you have any tools or like,
550
00:27:43.319 --> 00:27:46.799
what would you do to kind of like visualize the
551
00:27:47.240 --> 00:27:52.680
like you know, organizational structure in the in combination, Like
552
00:27:52.720 --> 00:27:55.400
it's more than just like secrets management, it seems right,
553
00:27:56.240 --> 00:27:58.960
Like how do you how do you personally visualize like
554
00:27:59.400 --> 00:28:02.640
the security aspects surrounding the secrets and who accesses them
555
00:28:02.880 --> 00:28:06.160
and things like that to understand kind of what is
556
00:28:06.200 --> 00:28:08.039
happening and where the access points are.
557
00:28:08.680 --> 00:28:13.559
Yeah, great question, truly a great question. We've tried really
558
00:28:13.640 --> 00:28:16.400
hard to build a model that maps very closely to
559
00:28:16.440 --> 00:28:20.200
what you'd have with code so with GitHub or get lab.
560
00:28:20.319 --> 00:28:23.039
So we have projects just like you have repos and
561
00:28:23.119 --> 00:28:26.559
get it and get lab, and we have environments which
562
00:28:26.559 --> 00:28:30.599
are very similar to branches, and then we have user
563
00:28:30.599 --> 00:28:33.880
groups that mapp in with access control policies, and then
564
00:28:33.920 --> 00:28:36.720
we have integrations that connect to those environments and so
565
00:28:36.880 --> 00:28:39.599
you can have these like this bare bones higerical structure
566
00:28:39.599 --> 00:28:42.640
of projects and environments. From there, you can assign users
567
00:28:42.640 --> 00:28:45.079
to them, and you can assign infrastructure that connects with them,
568
00:28:46.000 --> 00:28:48.960
and it's very easy within dppler to kind of see
569
00:28:49.000 --> 00:28:51.640
all that connect together in an extremely visual way. We
570
00:28:51.680 --> 00:28:54.440
even have to show kind of how far we've taken it.
571
00:28:54.640 --> 00:28:56.119
When you go into a project, you actually have a
572
00:28:56.160 --> 00:29:01.200
conbind board style user experience that shows all your different
573
00:29:01.279 --> 00:29:03.920
environments from development to staging to production everything in between.
574
00:29:05.359 --> 00:29:08.759
So what inspired you to start Droppler? Like where where
575
00:29:08.799 --> 00:29:11.359
does this story start? Like I'm curious, like where your
576
00:29:11.359 --> 00:29:14.640
background is, and you're like, oh, we need a better
577
00:29:14.880 --> 00:29:16.079
you know, secrets manager.
578
00:29:17.160 --> 00:29:19.799
Yeah, I had nothing to do with secrets. From the started.
579
00:29:20.079 --> 00:29:24.440
I was working on a crypto machine learning marketplace, so
580
00:29:24.440 --> 00:29:28.559
I'll kind of all the buzzwords in one on the side.
581
00:29:28.880 --> 00:29:31.039
It was literally every buzz where you can find jam
582
00:29:31.119 --> 00:29:36.000
together and man, that was a hard project. I worked
583
00:29:36.039 --> 00:29:37.799
on it for about eight months straight and it felt
584
00:29:37.799 --> 00:29:40.599
like pushing a massive boulder up a hill. Every foul
585
00:29:40.640 --> 00:29:43.759
fower I'd slipped five six five to six feet back
586
00:29:43.759 --> 00:29:47.240
from exhaustion. It was just hard and At one point,
587
00:29:47.279 --> 00:29:49.039
I like really got to my breaking more. I was like,
588
00:29:49.079 --> 00:29:50.519
I don't know if I can keep working on this thing,
589
00:29:50.759 --> 00:29:53.880
and so I decided to take a trip to Cancun, Mexico.
590
00:29:54.160 --> 00:29:56.400
And the whole goal was like, don't think about this
591
00:29:56.480 --> 00:30:01.160
project actively, do not And so I failed at that miserably.
592
00:30:01.599 --> 00:30:03.240
I was thinking about it the entire time I was there,
593
00:30:03.519 --> 00:30:05.839
And what I realized is that this problem I was
594
00:30:05.839 --> 00:30:07.480
never gonna be able to get this project off the ground.
595
00:30:07.480 --> 00:30:09.039
But that doesn't mean that I had to stop there.
596
00:30:10.480 --> 00:30:12.640
I think like there's a lot of people that like,
597
00:30:12.640 --> 00:30:15.359
like follow like sports players, and like they know all
598
00:30:15.400 --> 00:30:17.599
the stats of all these players. I'm very much the
599
00:30:17.599 --> 00:30:20.759
same way with founders. I like, I love learning about
600
00:30:20.799 --> 00:30:24.720
founder stories, and I think store Butterfield from Slack is
601
00:30:24.720 --> 00:30:27.519
like the best at failing off boards I've seen creates
602
00:30:27.519 --> 00:30:29.279
a video game out of that video game. The video
603
00:30:29.279 --> 00:30:31.279
game fails was born out of that was Flicker Comes
604
00:30:31.279 --> 00:30:32.640
Back a Second Times, Like I'm going to create a
605
00:30:32.680 --> 00:30:35.359
video game again. Born out of that was Slack, which
606
00:30:35.359 --> 00:30:37.880
we all use today. And so I was like, what
607
00:30:37.920 --> 00:30:42.359
can I learn from from my experience with this crypto
608
00:30:42.400 --> 00:30:45.440
machine Leary Marketplace and managing secrets was just one of
609
00:30:45.480 --> 00:30:47.559
them that was like super painful in all these weird,
610
00:30:47.640 --> 00:30:51.759
interesting ways. It was weird from a developer productivity side
611
00:30:51.799 --> 00:30:53.960
because I always felt like I was copying pasting things in.
612
00:30:54.200 --> 00:30:56.440
But sometimes the code would get into production faster than
613
00:30:56.480 --> 00:30:59.279
the secret sources have an outage. I had a couple
614
00:30:59.359 --> 00:31:01.000
of developers at was working with on this project, and
615
00:31:01.000 --> 00:31:02.680
I was like really painful to sink all these secrets
616
00:31:02.720 --> 00:31:04.759
with them, Like I would literally slack them and email
617
00:31:04.839 --> 00:31:07.559
them the secrets, and I, like my heart would cringe
618
00:31:07.599 --> 00:31:09.279
every time i'd do that, like, oh, that didn't feel right,
619
00:31:09.319 --> 00:31:11.440
But that's the only thing I have at my disposal
620
00:31:11.519 --> 00:31:15.400
to do. And there was actually one time where we
621
00:31:15.960 --> 00:31:18.279
dropped the crypto part of the marketplace because it wasn't working.
622
00:31:18.319 --> 00:31:21.519
We just did straight up machine learning marketplace using Stripe,
623
00:31:21.599 --> 00:31:23.559
and I had the Stripe production key in staging, and
624
00:31:23.599 --> 00:31:25.279
the staging went and prod and it took us a
625
00:31:25.279 --> 00:31:27.359
month to figure out why we weren't doing any transactions.
626
00:31:27.519 --> 00:31:31.200
And it was because of that because the Stripe testing
627
00:31:31.319 --> 00:31:34.480
key rejects all live credit cards, it only uses test
628
00:31:34.480 --> 00:31:37.160
credit cards, and we didn't realize that for a long time.
629
00:31:37.519 --> 00:31:40.160
And so I was like, Okay, this is a real problem.
630
00:31:40.880 --> 00:31:43.960
And so I come back from Cancun and I go
631
00:31:44.000 --> 00:31:45.759
to this dinner that Stripe was hosting that had a
632
00:31:45.759 --> 00:31:48.799
bunch of founders and developers at it, and we were
633
00:31:48.839 --> 00:31:50.559
all going around the room talking about what we were
634
00:31:50.559 --> 00:31:52.920
thinking about, and I just asked them openly, am I
635
00:31:52.960 --> 00:31:54.839
a shitty developer as the world broke? And I just
636
00:31:54.880 --> 00:31:57.920
can't tell anymore? Are you guys having this problem too?
637
00:31:57.960 --> 00:31:59.920
And like sixty percent of them were like, yes, this
638
00:32:00.119 --> 00:32:02.319
is a very big problem for us. And one woman
639
00:32:02.359 --> 00:32:05.279
in particular, like literally comes running up to me right afterwards.
640
00:32:05.400 --> 00:32:07.480
I thought she was going to trample me. And she says,
641
00:32:07.720 --> 00:32:10.319
I've had three outages this week, having a solution by Sunday.
642
00:32:10.480 --> 00:32:12.000
And I was like no, no, no, no, no, no, Like
643
00:32:12.079 --> 00:32:14.119
I'm not even started yet and this is a Wednesday.
644
00:32:14.119 --> 00:32:15.960
There's no way that's happening. And she goes, I don't
645
00:32:15.960 --> 00:32:18.400
give a fuck happen by Sunday. And I was like, okay,
646
00:32:18.799 --> 00:32:22.160
there are some interesting if people want it, but we
647
00:32:22.160 --> 00:32:24.799
didn't obviously have it by Sunday. That never happened. But
648
00:32:25.079 --> 00:32:26.319
what we did is we started doing a lot of
649
00:32:26.319 --> 00:32:29.319
research and we found that individual developers are struggling because
650
00:32:29.319 --> 00:32:32.799
there wasn't tools made for developers. Medium sized companies are
651
00:32:32.799 --> 00:32:35.359
struggling building their own things, and large companies were buying
652
00:32:35.440 --> 00:32:38.680
hash Core Vault, which really isn't meant to solve this problem,
653
00:32:38.759 --> 00:32:42.839
and still struggling. So like everyone's struggling, and I was like, Okay,
654
00:32:42.839 --> 00:32:45.240
we can build something that's developer first instead of instead
655
00:32:45.279 --> 00:32:48.799
of just purely secure first. And we got a first
656
00:32:48.880 --> 00:32:51.519
version working in three weeks. And we got a set
657
00:32:51.559 --> 00:32:53.680
of customers right after that by just dragging them in
658
00:32:53.720 --> 00:32:55.319
Chipola and saying hey, I'll get you anything on the
659
00:32:55.319 --> 00:32:56.880
menu as long as I get a rant at you
660
00:32:56.880 --> 00:32:59.160
for about two hours, and that got us our first
661
00:32:59.160 --> 00:33:01.440
set of customers. And after the races, we were.
662
00:33:02.200 --> 00:33:05.319
Yeah, it's funny. How Yeah, you wind up scratching an itch.
663
00:33:05.400 --> 00:33:07.839
That's not how do I put it, it's not like
664
00:33:07.880 --> 00:33:10.839
the core thing you were trying to build. Yeah, anyways,
665
00:33:11.759 --> 00:33:14.240
but sured out to be a good business. Yeah, it's
666
00:33:14.319 --> 00:33:16.400
It's interesting because I've been kind of in that same
667
00:33:16.519 --> 00:33:19.559
space where I've been looking for a solution that does
668
00:33:19.599 --> 00:33:21.519
a whole bunch of things that I want for the podcast,
669
00:33:21.640 --> 00:33:25.160
and I've just you know, so I built little pieces
670
00:33:25.240 --> 00:33:26.839
of it here and there, and so I finally just
671
00:33:26.880 --> 00:33:29.920
started bolting it together so that I have the full solution.
672
00:33:30.079 --> 00:33:33.759
And yeah, it's it's interesting how many how many times
673
00:33:33.799 --> 00:33:36.559
you have yeah things come out of that.
674
00:33:37.359 --> 00:33:40.319
Yeah, I would probably index and be like, Okay, are
675
00:33:40.480 --> 00:33:43.000
other people that I know that also do podcast recording
676
00:33:43.319 --> 00:33:43.839
asking for.
677
00:33:43.799 --> 00:33:45.079
This pool for the people?
678
00:33:45.680 --> 00:33:48.119
Does it continues to get better and better the more
679
00:33:48.160 --> 00:33:52.240
I mount onto this like hoshpodge of a product? And
680
00:33:52.559 --> 00:33:56.279
is that value going up exponentially not linearly? And if
681
00:33:56.319 --> 00:33:58.640
the both those answers are corra are yes, and you
682
00:33:58.680 --> 00:34:00.440
still feel like there's nothing in the market as anything
683
00:34:00.440 --> 00:34:02.559
close to you have a product, the question is is
684
00:34:02.559 --> 00:34:06.000
that products product tenets better than whatever's in the market,
685
00:34:06.039 --> 00:34:09.400
Because if it isn't ten x better or ten x different, uh, people,
686
00:34:09.480 --> 00:34:11.280
there won't be enough of a differentiator to create a
687
00:34:11.320 --> 00:34:11.800
buying event.
688
00:34:12.039 --> 00:34:12.440
I found.
689
00:34:12.480 --> 00:34:16.920
Right, So I'm curious, like what is some common like
690
00:34:17.079 --> 00:34:21.320
preventable breaches that you've encountered, and like how can developers
691
00:34:21.320 --> 00:34:21.920
emploid them?
692
00:34:22.000 --> 00:34:22.199
Right?
693
00:34:22.880 --> 00:34:25.280
Yeah, there's a couple that really come to mind. I mean,
694
00:34:25.920 --> 00:34:28.159
let's look at he.
695
00:34:28.280 --> 00:34:31.079
Left, like he's got some doozies of some stories.
696
00:34:32.280 --> 00:34:35.480
They're all public, Okay, So I'll share one that like
697
00:34:35.599 --> 00:34:37.400
isn't public, but I won't say the name of the company,
698
00:34:37.400 --> 00:34:41.360
and then I'll share a couple that are public. So, Twitch, Toyota,
699
00:34:41.760 --> 00:34:44.280
and Twitter all kind of had the exact same breach happen,
700
00:34:44.800 --> 00:34:49.400
and they had secrets in code. The code got leaked somehow,
701
00:34:49.440 --> 00:34:52.719
either by them leaking them opening up the repos themselves,
702
00:34:53.079 --> 00:34:55.239
or by hackers being able to get access to the
703
00:34:55.280 --> 00:34:58.360
get up account from an employee that got compromised. So
704
00:34:58.440 --> 00:35:02.119
like someone got called and said, hey, I'm your boss,
705
00:35:02.400 --> 00:35:04.800
and give me access to get up, and then the
706
00:35:04.840 --> 00:35:06.400
hacker got access to get up, and then from get
707
00:35:06.639 --> 00:35:08.719
from get up based on the code, and the code
708
00:35:08.719 --> 00:35:11.360
had the secrets in it, and boom, now the hackers
709
00:35:11.360 --> 00:35:13.119
are really off to the races. And that's like that
710
00:35:13.239 --> 00:35:16.840
happened multiple times and keeps happening because there wasn't a
711
00:35:16.920 --> 00:35:19.320
system in place to make sure your secrets never entered code.
712
00:35:19.559 --> 00:35:20.800
They should never be in code.
713
00:35:21.880 --> 00:35:24.000
Yeah, So I just want to just jump in here
714
00:35:24.599 --> 00:35:27.320
because essentially what you're telling us is just because your
715
00:35:27.320 --> 00:35:31.159
GitHub repo is private does not mean that you can
716
00:35:31.239 --> 00:35:33.920
check your secrets into it and expect them to stay safe.
717
00:35:34.400 --> 00:35:37.119
Absolutely. I mean that is like the number one thing
718
00:35:37.159 --> 00:35:39.840
most attackers are going after is like get Hub because
719
00:35:39.840 --> 00:35:42.639
they're assuming you're going to be making this exact mistake.
720
00:35:43.039 --> 00:35:46.199
And it's very easy to impersonate a boss, especially in
721
00:35:46.239 --> 00:35:49.199
the days of AI, So these attacks are going to
722
00:35:49.239 --> 00:35:51.400
get more and more sophisticated and feel more and more real,
723
00:35:51.440 --> 00:35:53.880
like you're actually talking with your boss and all of
724
00:35:53.920 --> 00:35:56.480
a sudden, boom, you have access or they have access,
725
00:35:57.719 --> 00:36:00.440
and then I'll tell a story. I can't the name
726
00:36:00.440 --> 00:36:02.679
of the company. I can promise you this. You have
727
00:36:02.760 --> 00:36:05.239
absolutely heard of the name of the company. You probably
728
00:36:05.280 --> 00:36:07.880
have used their product at some point in time, and
729
00:36:08.159 --> 00:36:11.320
they're very big. And this is before they were a
730
00:36:11.360 --> 00:36:16.519
customer of ours. They had a data breach where they
731
00:36:16.679 --> 00:36:18.400
hired a malicious actor in the company, so there was
732
00:36:18.400 --> 00:36:21.320
a rogue agent that they had hired. That rogue agent
733
00:36:21.639 --> 00:36:25.159
stole all their credentials or all their secrets, about two
734
00:36:25.239 --> 00:36:28.519
thousand of them. They detected a bit late in the
735
00:36:28.519 --> 00:36:33.079
game obviously exited that employee. But then the security team
736
00:36:33.119 --> 00:36:35.280
was tasked with rotating these secrets, so again swapping out
737
00:36:35.280 --> 00:36:37.039
the locks, making sure that all those secrets they stole
738
00:36:37.199 --> 00:36:40.760
aren't valid keys the locks anymore. And it took their
739
00:36:40.800 --> 00:36:45.840
security team six months across three engineers to rotate all
740
00:36:45.880 --> 00:36:48.159
of these credentials. So six months about that. That's not
741
00:36:48.239 --> 00:36:50.800
just like six months of only doing this and not
742
00:36:50.880 --> 00:36:53.719
doing any other projects and a major distraction, but also
743
00:36:53.760 --> 00:36:56.480
six months that the attackers got to steal data. Well,
744
00:36:56.639 --> 00:36:59.639
if data moves at gigabytes per second through AWS, they
745
00:36:59.679 --> 00:37:02.679
have an enormous amount of time to drain all the data, right,
746
00:37:03.199 --> 00:37:05.679
like they had all the time in the world. Basically,
747
00:37:05.840 --> 00:37:08.119
like when you're dealing in data breaches, you're dealing in
748
00:37:08.159 --> 00:37:11.960
seconds and minutes, not months. So months is an absolute
749
00:37:12.000 --> 00:37:15.840
insane amount of time that the attackers had to basically
750
00:37:15.960 --> 00:37:18.000
use all those stolen credentials to get anything they wanted
751
00:37:18.000 --> 00:37:20.360
out of the system or compromise system in any way.
752
00:37:21.119 --> 00:37:23.280
And it was from what we heard, it was quite
753
00:37:23.280 --> 00:37:25.920
a bit of a battle between the hackers and like
754
00:37:26.159 --> 00:37:28.400
just because you revoke the key, well if they use
755
00:37:28.440 --> 00:37:30.760
that key to create new keys, now you're like you
756
00:37:30.800 --> 00:37:34.639
have this cat and mouse game, right, And so it
757
00:37:34.679 --> 00:37:37.719
was quite a big challenge for them. Post oppler, they
758
00:37:38.199 --> 00:37:40.880
have a secret radition set up a whole level of
759
00:37:40.960 --> 00:37:44.360
orchestration with their infrastructure, and that same thing would have
760
00:37:44.360 --> 00:37:47.039
taken about like thirty seconds to minute. They clicked a
761
00:37:47.039 --> 00:37:51.280
button and it had been done. But yeah, it was quite
762
00:37:51.320 --> 00:37:53.800
painful for them, and you can imagine all the users
763
00:37:53.840 --> 00:37:57.360
that were deeply impacted by that along the way. It's
764
00:37:57.400 --> 00:37:59.880
not fun. I think that the surprising thing is like
765
00:38:00.039 --> 00:38:04.280
that I hear a lot is oh, this won't happen
766
00:38:04.360 --> 00:38:06.960
to me because my company is really big and we
767
00:38:06.960 --> 00:38:09.599
had the best security team. Or I also hear the
768
00:38:09.679 --> 00:38:12.480
quite the other in versual chapters all the time of
769
00:38:12.559 --> 00:38:15.880
like I'm a small startup, packers won't care about my company, right,
770
00:38:16.159 --> 00:38:18.400
and like you hear this from both from the opposite sides,
771
00:38:18.440 --> 00:38:20.800
like the stars are saying one thing, that the big
772
00:38:20.840 --> 00:38:24.760
companies are saying the other. And the truth is hackers
773
00:38:24.800 --> 00:38:27.480
are just looking for any company that they can exploit,
774
00:38:27.920 --> 00:38:30.400
does not matter if big and small. They're looking for prices.
775
00:38:30.639 --> 00:38:34.000
Sometimes they hit a jackpot, million dollar payouts, sometimes they
776
00:38:34.000 --> 00:38:37.119
get a ten k payout right, and like are small
777
00:38:37.360 --> 00:38:39.159
a small attack or a big attack, But they're just
778
00:38:39.199 --> 00:38:43.199
looking to make an exploit and so really every and
779
00:38:43.199 --> 00:38:45.440
that's why the number of data breaches are just rising
780
00:38:45.480 --> 00:38:48.880
exponentially every single year. Like if you look at the graphics, terrifying,
781
00:38:49.920 --> 00:38:51.719
and it's getting and it's getting cheaper and cheaper for
782
00:38:51.760 --> 00:38:54.000
them to do that because the techniques are getting more
783
00:38:54.000 --> 00:38:55.920
and more understood, the AI is getting better and better
784
00:38:55.960 --> 00:38:58.679
at doing this, So it's it's a really big growing problem. So,
785
00:38:58.719 --> 00:39:00.880
like everyone is vulnerable. It's not just if you're startup
786
00:39:00.920 --> 00:39:02.679
you're insulated because of your scale, or if you're a
787
00:39:02.760 --> 00:39:05.199
large company you have your invulnerable because of your scale.
788
00:39:05.280 --> 00:39:08.239
Like Microsoft got hacked, and Video got hacked, Samsung got hacked,
789
00:39:08.400 --> 00:39:10.440
Like these are really really large companies that you think
790
00:39:10.440 --> 00:39:12.840
would have their stuff together and still they got hacked.
791
00:39:14.039 --> 00:39:17.519
So it is it's on all of us, every single
792
00:39:17.519 --> 00:39:19.760
every all of us are responsible for keeping these credentials
793
00:39:19.760 --> 00:39:21.519
safe so we keep our users safe.
794
00:39:22.039 --> 00:39:24.079
Yeah, I think you make a great point. I mean
795
00:39:24.360 --> 00:39:26.840
being able to RESIGND quickly is definitely like high up
796
00:39:26.840 --> 00:39:29.639
on that list and being able to remediate that as
797
00:39:29.639 --> 00:39:32.519
fast as possible because it will happen, like you kind
798
00:39:32.519 --> 00:39:35.960
of just like have to go with Eventually something will
799
00:39:36.000 --> 00:39:39.119
happen and you have to like just stop it as
800
00:39:39.159 --> 00:39:43.960
soon as possible, and in my experience, just having that
801
00:39:44.239 --> 00:39:49.920
ability to move quickly to rotate things around has been
802
00:39:50.079 --> 00:39:55.239
like the best defense in the long run, at least
803
00:39:55.280 --> 00:39:57.400
from minimizing damage.
804
00:39:57.519 --> 00:40:00.519
Right, agree, Like when you're in a firefight, you shouldn't
805
00:40:00.519 --> 00:40:02.719
be strategizing how to fight the firefight. You should just
806
00:40:02.719 --> 00:40:05.480
be doing the strategizing should have happened before the firefighting
807
00:40:05.480 --> 00:40:08.639
happ right. You just want to be an execution mode
808
00:40:08.639 --> 00:40:10.280
when that happens, and you want the execution mode to
809
00:40:10.320 --> 00:40:12.039
be as quick as possible, Like you should click a
810
00:40:12.039 --> 00:40:14.079
button and should be done thirty seconds later and that's it.
811
00:40:14.599 --> 00:40:17.559
Yeah. This it just reminds me to a story. I
812
00:40:18.159 --> 00:40:21.639
forget what the company was, but some some like you know,
813
00:40:22.559 --> 00:40:26.440
software engineer at a big company had a home plex
814
00:40:26.480 --> 00:40:30.880
server and the plexnerver was outdated and it gave like
815
00:40:32.119 --> 00:40:34.599
you know, access to their home network, and on their
816
00:40:34.599 --> 00:40:38.039
home network was a work laptop that they then were
817
00:40:38.079 --> 00:40:39.800
able to gain access to because it was on a
818
00:40:39.840 --> 00:40:44.360
shared network. And then from there they then hopped through
819
00:40:44.360 --> 00:40:49.960
remote systems and so it's like you know, the you're right,
820
00:40:49.960 --> 00:40:53.719
it's getting much more like evolved.
821
00:40:54.320 --> 00:40:57.719
Oh yeah, Like there's some interesting ones that I've heard
822
00:40:57.719 --> 00:41:01.079
of recently of like printers like old printers that are
823
00:41:01.119 --> 00:41:04.079
connected to Wi Fi getting exploited, or like everyone has
824
00:41:04.119 --> 00:41:06.320
all these IoT devices in their home that are connected
825
00:41:06.360 --> 00:41:10.480
to like the home hub system for Apple or Alexa
826
00:41:10.599 --> 00:41:13.480
or whatever, and those are Internet connected to so like
827
00:41:13.559 --> 00:41:16.000
a very small device can then basically get access to
828
00:41:16.000 --> 00:41:17.639
the Wi Fi network, which then gets access to every
829
00:41:17.639 --> 00:41:20.960
device on that network, and thus the attack starts. So
830
00:41:21.400 --> 00:41:24.039
there's a lot of exploits outside that that don't have
831
00:41:24.119 --> 00:41:26.920
to start with just your computer or just AWS.
832
00:41:27.760 --> 00:41:31.159
So let's say that I don't know I'm cheap and
833
00:41:31.199 --> 00:41:33.679
I don't want to use something like Doppler. I don't
834
00:41:33.679 --> 00:41:37.440
even know what you cost. Maybe it's like ridiculously inexpensive.
835
00:41:37.840 --> 00:41:39.920
But let's just say that, you know, I decide, for
836
00:41:39.960 --> 00:41:42.920
whatever reason, I want to do this by myself. What
837
00:41:43.440 --> 00:41:44.159
does that look like.
838
00:41:44.800 --> 00:41:48.280
Yeah, well, first off, Doppler are super cheap for free
839
00:41:48.320 --> 00:41:54.199
actually to start, so it doesn't get keeper than that. Yeah,
840
00:41:54.239 --> 00:41:56.239
it's free from the first three years users, and then
841
00:41:56.239 --> 00:41:59.360
it's basically get hub priced from there. So if you're
842
00:41:59.400 --> 00:42:01.199
comfortable paying for get Up, you should be comfortable playing
843
00:42:01.199 --> 00:42:04.679
for Doppler. But let's say you don't want to do
844
00:42:04.679 --> 00:42:08.599
that for whatever reason. I think the most important thing
845
00:42:08.639 --> 00:42:09.840
you can do if you're not going to use any
846
00:42:09.840 --> 00:42:14.280
tooling at all, is or bare minimum tooling is used
847
00:42:14.320 --> 00:42:17.599
like a cloud secrets provider like AWS Secrets Manager, GCP
848
00:42:17.679 --> 00:42:21.159
Secrets Manager and so on, and then build some tooling
849
00:42:21.199 --> 00:42:24.519
around it so that you can fetch secrets locally in
850
00:42:24.559 --> 00:42:27.440
development without them touching disc So what you need to
851
00:42:27.440 --> 00:42:31.239
do is have some wrapper around your application that starts
852
00:42:31.239 --> 00:42:34.119
your application. So I'd imagine the workflow would be like
853
00:42:34.119 --> 00:42:36.719
fetch secrets from a to BA secrets manager, inject them
854
00:42:36.719 --> 00:42:39.400
into the environment or write them to an encrypted file,
855
00:42:39.840 --> 00:42:44.519
and then have the decryption key in the environment. Either pathworks,
856
00:42:44.800 --> 00:42:46.920
and then once the application starts, you clean up the
857
00:42:47.000 --> 00:42:50.079
environment and then load all your other dependencies. And if
858
00:42:50.079 --> 00:42:53.039
you did that plus having year secrets and a to
859
00:42:53.079 --> 00:42:56.360
B A secrets manager and that being the same process
860
00:42:56.360 --> 00:43:00.880
happening for production workloads, at least you solve most of
861
00:43:00.920 --> 00:43:04.199
the risk. In my mind. Also, when you're doing this
862
00:43:04.639 --> 00:43:06.480
and this where things get a little bit more of
863
00:43:06.480 --> 00:43:13.119
a burden because eight of US credit or managing privileges
864
00:43:13.159 --> 00:43:15.280
like I am roles is quite complicated, in my opinion,
865
00:43:15.800 --> 00:43:17.480
is You're going to want to make sure that every
866
00:43:17.480 --> 00:43:23.480
individual developer and every set of infrastructure has their own identity,
867
00:43:23.840 --> 00:43:26.840
and that way you have robust audit logs of like, Okay,
868
00:43:26.880 --> 00:43:29.280
the secret is taken by X developer at this time
869
00:43:29.719 --> 00:43:31.480
or read by this time, and we can we have
870
00:43:31.559 --> 00:43:34.119
this auditor of what happened. So you don't want to
871
00:43:34.119 --> 00:43:36.800
basically create one master i AM credential and just share
872
00:43:36.800 --> 00:43:38.199
it with your entire team, because then you lose a
873
00:43:38.199 --> 00:43:41.840
lot of your auditing story along with it. And you
874
00:43:41.960 --> 00:43:43.840
also probably want to set up if you have a
875
00:43:43.840 --> 00:43:46.880
little bit extra time to spend an auditing story around reads.
876
00:43:46.960 --> 00:43:50.119
So every time a secret is downloaded from this endpoint,
877
00:43:50.159 --> 00:43:51.280
you're going to want to make sure that you have
878
00:43:51.280 --> 00:43:53.280
the right logging and auditing set up in a WS
879
00:43:53.280 --> 00:43:56.119
for that, and that you're actually looking at those logs
880
00:43:56.119 --> 00:44:02.960
and have analysis over those logs absolute bare minimum.
881
00:44:03.000 --> 00:44:05.119
One other thing that I've seen and I think that
882
00:44:05.159 --> 00:44:09.000
I saw this on the camal, which is a deployment
883
00:44:09.159 --> 00:44:15.559
system that was written by David Heinemeier Hansen, and anyway
884
00:44:16.000 --> 00:44:20.119
it can pull secrets from like one password. Yeah, you've
885
00:44:20.119 --> 00:44:23.440
seen people using one password for their secrets management.
886
00:44:24.599 --> 00:44:28.440
Less and less, so they they added something called one
887
00:44:28.480 --> 00:44:33.039
Password Secrets Automation. Everything that I've heard from my community
888
00:44:33.119 --> 00:44:35.599
is that they are not actively investing in that product anymore.
889
00:44:35.960 --> 00:44:40.320
And it's kind of like shelfware now, so she never
890
00:44:40.360 --> 00:44:43.360
heard that it's there, it's available, you can use it,
891
00:44:43.400 --> 00:44:46.000
but it's not actively being invested in. It's on the shelf.
892
00:44:47.400 --> 00:44:49.400
But the amount of people every year that I hear
893
00:44:49.480 --> 00:44:51.559
using is less and less because a I think there's
894
00:44:51.599 --> 00:44:55.679
like first class products now that that really work, and
895
00:44:57.039 --> 00:44:58.840
the amount of things that you want out of secret
896
00:44:58.920 --> 00:45:02.079
Manager is growing far faster than what they're adding to,
897
00:45:02.119 --> 00:45:04.840
which is at this pace for my are staying at zero.
898
00:45:05.519 --> 00:45:07.360
But you can't do it. I mean like secrets Manage
899
00:45:07.440 --> 00:45:10.599
or one Pastor is engen encrypted, so like you're getting
900
00:45:10.599 --> 00:45:12.400
a lot of security benefits from that. So I'm not
901
00:45:12.440 --> 00:45:14.199
gonna say, hey, don't ever use it. If if it
902
00:45:14.280 --> 00:45:17.639
push came to shove, use it. I just think there's
903
00:45:17.639 --> 00:45:20.199
like far better things that are also easier to use
904
00:45:20.199 --> 00:45:24.679
in far better priced out there that are really available.
905
00:45:25.159 --> 00:45:28.039
Valentino, look steep and fun is.
906
00:45:28.440 --> 00:45:34.400
Is uh Doppler part of the GitHub secret Scanning? Yeah, yep,
907
00:45:34.880 --> 00:45:35.360
that's all.
908
00:45:35.239 --> 00:45:37.800
Sark if you if there is a Doppler token, a
909
00:45:37.840 --> 00:45:41.800
Doppler issue token found on GitHub gettabile, contact us immediately,
910
00:45:41.840 --> 00:45:44.679
will immediately revoke the token, notify you and work with
911
00:45:44.760 --> 00:45:49.519
you generated your token, and we're going to be investing
912
00:45:49.559 --> 00:45:52.320
next year pretty aggressively in the secret scanning space as
913
00:45:52.320 --> 00:45:54.920
well of like really having a full auto picture there,
914
00:45:54.920 --> 00:45:57.039
Like I'd love to be able to say, hey, we
915
00:45:57.239 --> 00:45:59.880
found some secrets in your code, We've automackally revoked them,
916
00:46:00.119 --> 00:46:01.679
your new ones, and those new secrets are now and
917
00:46:02.320 --> 00:46:05.800
not in your code anymore. Like some really powerful workflows
918
00:46:05.800 --> 00:46:08.519
like that can just make sure that even though the
919
00:46:08.559 --> 00:46:10.199
tooling is set up so that you'd want to use it,
920
00:46:10.239 --> 00:46:12.719
if you actually don't use it and you fall back
921
00:46:12.760 --> 00:46:14.440
to bad habits, that the system catches you.
922
00:46:16.039 --> 00:46:19.639
Yeah, I'm curious on like as far as the observability goes,
923
00:46:19.800 --> 00:46:23.079
Like what are the latest like friends happening now for
924
00:46:23.239 --> 00:46:29.519
like observing like secret use and like maybe detecting bad actors,
925
00:46:29.559 --> 00:46:31.199
you know, ahead of the breach.
926
00:46:32.679 --> 00:46:35.320
Detection ahead of the breach at least in the secret
927
00:46:35.320 --> 00:46:39.280
space is almost zero from my understanding right now, it's there.
928
00:46:39.320 --> 00:46:42.800
There isn't a classic tool yet for that. But on
929
00:46:42.840 --> 00:46:47.880
the scanning side, there there's Trufflehog, there's get Guardian. Get
930
00:46:47.960 --> 00:46:51.440
ub is adding some stuff too. There is a space
931
00:46:51.480 --> 00:46:54.599
developing right now where basically you can scan. The goal
932
00:46:54.639 --> 00:46:56.519
is to scan the perimeter of your infrastructure, right, so
933
00:46:56.639 --> 00:47:01.760
like Slack, Microsoft teams, email, your code base, all of
934
00:47:01.760 --> 00:47:06.800
that infrastructure basically be scann in real time for secrets.
935
00:47:07.880 --> 00:47:10.559
That's basically the extent of what we have today. The
936
00:47:10.599 --> 00:47:12.440
problem is like you have to connect those dots, right, So, like,
937
00:47:12.480 --> 00:47:14.280
you found a secret, what do you do next? Right,
938
00:47:14.559 --> 00:47:16.800
especially if you're like an individual developer, you don't control
939
00:47:16.800 --> 00:47:19.920
the secret manager that's being used. You don't control or
940
00:47:19.960 --> 00:47:22.039
if they're not using a secrets manager, what the flow is.
941
00:47:22.320 --> 00:47:24.639
And so like if you're in if you like a class,
942
00:47:24.679 --> 00:47:26.320
example that I hear all the time is, oh, we
943
00:47:26.360 --> 00:47:28.519
added a secret scanner, and the secret scanner found all
944
00:47:28.519 --> 00:47:32.159
of our INBI files, but the companies decided we use
945
00:47:32.199 --> 00:47:34.159
eb files. So like now it's a mood point because
946
00:47:34.199 --> 00:47:36.639
we know we've always known secrets we're in code because
947
00:47:36.639 --> 00:47:38.840
they're in eb files, but there's nothing to get us
948
00:47:39.159 --> 00:47:40.880
to the next step of like getting it out of code.
949
00:47:41.400 --> 00:47:43.320
So now all you're doing is surfacing a problem that
950
00:47:43.360 --> 00:47:46.880
we can't solve. So I think that's really where like
951
00:47:47.239 --> 00:47:50.719
we're trying to help move the industry is connecting those dots.
952
00:47:50.760 --> 00:47:52.360
You found a secret, and you can immediately take an
953
00:47:52.400 --> 00:47:54.400
action or an action is taken on your behalf based
954
00:47:54.480 --> 00:47:57.480
on a policy to clean up the mess.
955
00:47:57.679 --> 00:47:59.119
I'm gonna have to go back and listen to this
956
00:47:59.199 --> 00:48:00.960
and then go through all my stuff.
957
00:48:01.559 --> 00:48:05.599
Run your checklist. Yeah, do you have a checklist, Brian
958
00:48:06.119 --> 00:48:09.360
of like you know at least run through this for
959
00:48:09.519 --> 00:48:13.039
your projects or your team or do you publish anything
960
00:48:13.039 --> 00:48:13.440
around that?
961
00:48:14.239 --> 00:48:15.800
Yeah. We have a couple of blog posts said that
962
00:48:16.400 --> 00:48:20.639
highlight like basic secrets management practices outside of the stuff
963
00:48:20.639 --> 00:48:25.880
I already shared today around working with like his cloud provider,
964
00:48:27.000 --> 00:48:31.280
I would strongly recommend having a secret scanner, so Truffle
965
00:48:31.320 --> 00:48:34.559
ogs free use it it's open source, or get Guardian
966
00:48:35.639 --> 00:48:39.760
both the partners of ours. The other big thing is
967
00:48:40.159 --> 00:48:42.519
outside of secrets, I would have a vulnerability scanner really
968
00:48:42.559 --> 00:48:48.199
important on all your major dependency streams, so like Docker, images, Ruby, gems,
969
00:48:48.400 --> 00:48:52.519
if you're using Node, NPM, but basically any dependency you have,
970
00:48:52.559 --> 00:48:55.880
you should have vulnerability scanning on it. Super freaking important
971
00:48:56.159 --> 00:48:59.039
because it's so easy these days for like one dependency
972
00:48:59.039 --> 00:49:02.119
that nobody's cared about for ten years to just get
973
00:49:02.159 --> 00:49:05.119
bought for like a couple hundred bucks, and then someone
974
00:49:05.159 --> 00:49:08.760
pushes an update for it, and all the other dependencies
975
00:49:08.800 --> 00:49:11.360
having frozen on that older version, and so now all
976
00:49:11.400 --> 00:49:13.800
these dependencies get that update, which means you get the update,
977
00:49:13.800 --> 00:49:15.719
and that update has motious code in it, and that's
978
00:49:15.760 --> 00:49:19.639
like a very common paradigm for attack these days. So
979
00:49:20.360 --> 00:49:25.280
a freezer, you're right your dependencies, meaning like I'm fixed
980
00:49:25.320 --> 00:49:28.000
at this version and no amount of them pushing a
981
00:49:28.039 --> 00:49:30.719
new update will change that. I'm on this version and
982
00:49:30.760 --> 00:49:35.159
this version has been like guaranteed good, no vulnerabilities in it,
983
00:49:36.000 --> 00:49:38.920
and that at least can help prevent any issues where
984
00:49:39.320 --> 00:49:42.519
like a vulnerable code gets pushed up and you guys
985
00:49:42.559 --> 00:49:44.880
immediately get attacked from it. What you really want is
986
00:49:44.880 --> 00:49:48.199
you want all your dependencies frozen, and then when a
987
00:49:48.280 --> 00:49:50.719
new exploit happens, you go, oh, that was kind of
988
00:49:50.760 --> 00:49:54.559
cool where you are using that package, but our version
989
00:49:54.639 --> 00:49:56.800
doesn't have that problem, so we're good, And then you
990
00:49:56.840 --> 00:49:58.119
just wait for the fix to come out and then
991
00:49:58.159 --> 00:50:01.599
you can do another refresher another update.
992
00:50:02.079 --> 00:50:04.960
Cool, anything else that you guys want to dive into.
993
00:50:07.199 --> 00:50:10.960
So give us kind of the the what two minute
994
00:50:10.960 --> 00:50:14.800
pitch on on Doppler. Just still let people know what
995
00:50:14.840 --> 00:50:16.880
it does and how makes your life better.
996
00:50:17.440 --> 00:50:20.840
Yeah. So at the end of day, Doppler makes your
997
00:50:20.840 --> 00:50:22.559
life better in a couple of ways. One, it's gonna
998
00:50:22.559 --> 00:50:26.119
add two hours of productivity per developer per week, so
999
00:50:26.840 --> 00:50:29.199
in a way it kind of pays for itself. On
1000
00:50:29.239 --> 00:50:30.800
top of that, it's going to make you far more
1001
00:50:30.800 --> 00:50:33.840
secure from an organization standpoint, managing your secrets so you
1002
00:50:33.840 --> 00:50:37.000
can get You can sign up today by creating account
1003
00:50:37.360 --> 00:50:40.719
for free, and then if you're much much larger org
1004
00:50:40.760 --> 00:50:42.639
you can talk to our solutions entering team who can
1005
00:50:42.880 --> 00:50:45.639
help figure out how this integrates into your complex infrastructure.
1006
00:50:46.559 --> 00:50:48.360
We have a whole host of great companies that are
1007
00:50:48.440 --> 00:50:52.079
using us, so you're not alone from a center Krumble Cookies,
1008
00:50:52.119 --> 00:50:59.400
Puma Children's Cancer Institute, stock x Travel, trip Advisor, so
1009
00:50:59.400 --> 00:51:01.000
there's a number of g companies you won't be alone
1010
00:51:01.000 --> 00:51:04.320
on this side. And we manage about thirty billion secrets
1011
00:51:04.360 --> 00:51:07.719
a month right now, so like at quite large scale.
1012
00:51:08.559 --> 00:51:11.280
And I think the key thing here if you decide
1013
00:51:11.280 --> 00:51:13.880
not to use Doppler is at least manage your secrets.
1014
00:51:14.119 --> 00:51:15.719
Like at the end day, I think we are all
1015
00:51:15.760 --> 00:51:18.519
tired of data breaches happening because they keep impacting us
1016
00:51:18.960 --> 00:51:21.239
and they impact your customers. And so if you're not
1017
00:51:21.239 --> 00:51:22.960
going to use Doppler, that's totally fine by me. You
1018
00:51:22.960 --> 00:51:25.800
could even use a competitor. Just use a secrets manager
1019
00:51:25.960 --> 00:51:26.920
protect those secrets.
1020
00:51:27.119 --> 00:51:30.840
I'm a little gratified you mentioned Grumble Cookies, their local company. Anyway,
1021
00:51:32.639 --> 00:51:34.440
let's go ahead and do our picks and then we'll
1022
00:51:34.440 --> 00:51:37.159
wrap up now. I don't know if you had a
1023
00:51:37.239 --> 00:51:39.159
chance to listen to other episodes of the show, but
1024
00:51:39.199 --> 00:51:42.760
we just shout out about stuff that we're playing doing
1025
00:51:42.880 --> 00:51:46.559
or that we like. Valentino, do you want to start
1026
00:51:46.639 --> 00:51:47.000
us off?
1027
00:51:47.360 --> 00:51:49.679
Sure? Yeah, I mean the first thing that comes to
1028
00:51:49.760 --> 00:51:52.840
mind is the Dark Knight Diaries podcast, which is just
1029
00:51:52.920 --> 00:51:59.599
like an incredible resource of deep diving exploits and just
1030
00:51:59.639 --> 00:52:02.280
like people, people are just so creative out there and
1031
00:52:02.480 --> 00:52:05.639
uh nefarious or not. It's just like wild to see
1032
00:52:05.679 --> 00:52:08.639
what uh what kind of attack vectors there are and
1033
00:52:08.920 --> 00:52:12.440
how people are using and exploding your behavior, which it
1034
00:52:12.480 --> 00:52:16.119
can be patterned, right, So I'd recommend if you're interested
1035
00:52:16.119 --> 00:52:18.760
in any of that kind of stuff, It's it's an
1036
00:52:18.760 --> 00:52:24.280
awesome show. Next to that, I've been following a lot
1037
00:52:24.320 --> 00:52:28.400
of the Rails World fallout, which is just like, uh,
1038
00:52:28.519 --> 00:52:33.440
I've definitely missed out. I wanted to go to conference. Yeah,
1039
00:52:33.559 --> 00:52:36.480
there's so much, so much great stuff that I'm just
1040
00:52:36.519 --> 00:52:40.400
watching from Afar come out of that and it's really exciting.
1041
00:52:40.920 --> 00:52:44.239
Uh So, I guess just watch the YouTube channel for
1042
00:52:44.599 --> 00:52:47.400
updates of new talks that are coming out of there.
1043
00:52:49.599 --> 00:52:54.559
And then the last pick I have is Landing Gray.
1044
00:52:56.440 --> 00:53:00.000
He's in the Ruby AI space and he basically made
1045
00:53:00.199 --> 00:53:04.679
stream lit for Ruby, which I'm really excited to mess
1046
00:53:04.679 --> 00:53:06.880
around with. And if you're not familiar with stream lit,
1047
00:53:07.000 --> 00:53:10.760
it's kind of like the uh you know, I don't
1048
00:53:10.760 --> 00:53:14.119
know if it's JavaScript or it's some other language, but
1049
00:53:14.159 --> 00:53:16.840
it's what a lot of the you know, machine learning
1050
00:53:17.000 --> 00:53:20.320
enthusiasts will use to just quickly get up a chat
1051
00:53:20.360 --> 00:53:23.960
and uh, you know, fine tune or use lms in
1052
00:53:24.000 --> 00:53:28.079
creative ways. And lang Chain is kind of like promoted
1053
00:53:28.079 --> 00:53:31.320
it for a long time for just quickly iterating through
1054
00:53:31.920 --> 00:53:36.320
AI products development, and it's been really incredible just like
1055
00:53:36.400 --> 00:53:38.840
quickly get up and running if you on something new,
1056
00:53:39.400 --> 00:53:41.159
and so I'm excited to see that come to Ruby
1057
00:53:41.760 --> 00:53:45.039
in a very like Ruby way. So it looks very
1058
00:53:45.119 --> 00:53:48.280
much like you know, a rack app or or something
1059
00:53:48.360 --> 00:53:50.920
like that where you can just run it and it
1060
00:53:50.960 --> 00:53:53.760
has a chat that you can use, and I'm really
1061
00:53:53.760 --> 00:53:55.800
excited to see that develop more.
1062
00:53:58.119 --> 00:54:00.239
Cool. I'm gonna throw in my picks, So the first
1063
00:54:00.239 --> 00:54:03.079
one I always do a board game pick. I'm gonna
1064
00:54:03.079 --> 00:54:08.039
pick keep the Heroes out. So the kind of the
1065
00:54:08.079 --> 00:54:09.960
design of the game and stuff is kind of like
1066
00:54:10.039 --> 00:54:15.280
a dungeon for like D and D, except simplified, and
1067
00:54:16.719 --> 00:54:20.719
you're not playing the heroes, you're playing the monsters. And
1068
00:54:20.760 --> 00:54:24.880
so each player gets to play a different set of
1069
00:54:24.920 --> 00:54:29.519
monsters and they have different abilities. And so the way
1070
00:54:29.519 --> 00:54:32.840
that you play is you take your turn by you know,
1071
00:54:33.199 --> 00:54:35.360
playing your cards. So you have a deck of cards
1072
00:54:35.679 --> 00:54:37.280
and so it's a little bit of a deck building
1073
00:54:37.320 --> 00:54:41.639
game and you can do all kinds of stuff. You
1074
00:54:41.679 --> 00:54:46.719
can move, you can create artifacts, you can do stuff
1075
00:54:46.760 --> 00:54:48.719
with the artifacts depending on which room you're in and
1076
00:54:48.719 --> 00:54:53.360
what actions are available to you and anyway, you can
1077
00:54:53.360 --> 00:54:56.639
also spawn new monsters, you know, again depending on what
1078
00:54:56.719 --> 00:55:01.000
actions you can take, and so then after you do
1079
00:55:01.079 --> 00:55:04.079
all your stuff, then what happens is then you spawn heroes,
1080
00:55:04.760 --> 00:55:08.760
and so you draw the card and it tells you
1081
00:55:08.800 --> 00:55:10.599
what rooms to put, what kinds of heroes in. The
1082
00:55:10.599 --> 00:55:14.559
heroes do their special abilities, and then they'll either attack
1083
00:55:14.679 --> 00:55:17.880
monsters or try to open the chests in the room,
1084
00:55:18.199 --> 00:55:20.800
or if they can't do either of those two things,
1085
00:55:21.559 --> 00:55:28.000
then they'll move one step closer to the vault and so.
1086
00:55:28.199 --> 00:55:30.159
And the chests are numbered, so if it's a one,
1087
00:55:30.199 --> 00:55:33.440
then it takes one activated hero to open it. If
1088
00:55:33.440 --> 00:55:35.280
it's a two, it takes two. You kind of get
1089
00:55:35.280 --> 00:55:42.599
the idea. So anyway, it that's essentially the game. There
1090
00:55:42.599 --> 00:55:45.000
are a couple of other you know, nuances to it,
1091
00:55:45.119 --> 00:55:47.880
and of course it has a series of dungeons that
1092
00:55:47.880 --> 00:55:52.159
you can play through, and so you know, they're different
1093
00:55:52.199 --> 00:55:54.320
rules for the different dungeons as far as how they work.
1094
00:55:55.039 --> 00:55:59.159
The way you win is you exhaust the hero pile twice,
1095
00:56:00.199 --> 00:56:05.880
and yeah, the way you lose is if the heroes
1096
00:56:06.000 --> 00:56:09.599
opened the chest in the vault, which is the four chest.
1097
00:56:09.760 --> 00:56:15.280
So anyway, really fun game takes about what forty five
1098
00:56:15.320 --> 00:56:20.679
minutes ish to play. The artwork on it is awesome.
1099
00:56:21.000 --> 00:56:26.639
The different types of Monsters are fun and so, yeah,
1100
00:56:26.719 --> 00:56:29.000
I've played it. It plays one to four players. I've
1101
00:56:29.000 --> 00:56:32.599
played it with three and four players, and anyway, it's
1102
00:56:32.639 --> 00:56:38.320
a fun game. Yeah, so I'm gonna pick that. And
1103
00:56:38.360 --> 00:56:42.039
then one movie I've been wanting to watch for a while,
1104
00:56:43.719 --> 00:56:45.800
mostly because I just heard it was really good, is
1105
00:56:45.880 --> 00:56:51.679
He'll Billy Ellogy. Now. I recognize that this is the
1106
00:56:52.559 --> 00:56:56.960
memoir by jd Vance, who's currently Donald Trump's running mate.
1107
00:56:57.280 --> 00:57:00.960
So politics aside, right, and I try not to get
1108
00:57:01.000 --> 00:57:04.599
into it too much on this show. Longtime listeners know
1109
00:57:04.639 --> 00:57:07.079
where I stand on all this stuff, but I don't
1110
00:57:07.079 --> 00:57:10.000
want to make the show about politics. But the story
1111
00:57:10.079 --> 00:57:13.239
is amazing, and you know the fact that you know,
1112
00:57:13.360 --> 00:57:18.719
this kid can come from basically the kind of place
1113
00:57:18.800 --> 00:57:22.480
and lifestyle that he did and then become you know,
1114
00:57:23.039 --> 00:57:25.840
wind up going to Yale Law School and then you know,
1115
00:57:25.880 --> 00:57:28.519
becoming a US senator. I mean, I just find that
1116
00:57:28.559 --> 00:57:32.880
incredibly inspiring. And you know, at the end of the day,
1117
00:57:32.920 --> 00:57:35.480
then you know how you feel about him. Now whatever,
1118
00:57:35.599 --> 00:57:39.000
it's really well done. It has Glenn Close and Amy
1119
00:57:39.000 --> 00:57:41.800
Adams in it. I haven't read the book, so I
1120
00:57:42.400 --> 00:57:46.679
don't know how closely they stuck to it. But anyway,
1121
00:57:47.360 --> 00:57:50.920
there were just several I think life lessons that anybody
1122
00:57:50.960 --> 00:57:56.840
can benefit from from the standpoint of, hey, look, if
1123
00:57:57.519 --> 00:58:01.400
you really want these things out of your life, then
1124
00:58:02.360 --> 00:58:04.000
you can go have them if you're willing to do
1125
00:58:04.039 --> 00:58:08.199
what it takes. And so you know, from that standpoint, Yeah,
1126
00:58:08.480 --> 00:58:12.800
I really liked the movie. There was something else I
1127
00:58:12.840 --> 00:58:15.639
was going to pick and I just oh, yeah, it
1128
00:58:15.719 --> 00:58:19.719
was the micro film And this one is on the
1129
00:58:19.760 --> 00:58:24.400
Angel Studios app. I think it's called something Something to
1130
00:58:24.440 --> 00:58:30.000
Stand For. And this is more it's almost a documentary.
1131
00:58:30.440 --> 00:58:32.719
So if you've listened to the rest of the story
1132
00:58:32.719 --> 00:58:35.760
by Paul Harvey, it's kind of based on that. That's
1133
00:58:35.800 --> 00:58:38.719
also the premise of Mike's podcast, at least when he
1134
00:58:38.760 --> 00:58:40.920
started it. Now he just interviews people that are interesting
1135
00:58:40.920 --> 00:58:44.480
to him. But what he would do is he would
1136
00:58:44.480 --> 00:58:47.920
tell a story without telling you who it was about, right,
1137
00:58:48.360 --> 00:58:50.000
And so at the end then he were, you know,
1138
00:58:50.039 --> 00:58:54.480
there's the big reveal and so this person was, you know,
1139
00:58:54.639 --> 00:58:57.559
Neil Armstrong or whatever, right, and you know, and so
1140
00:58:57.639 --> 00:59:00.199
that's the rest of the story is kind of the idea.
1141
00:59:00.239 --> 00:59:03.159
And so he tells a bunch of those from US history,
1142
00:59:04.239 --> 00:59:07.519
from moments that in some way shaped the direction of
1143
00:59:07.519 --> 00:59:11.480
the country And anyway, I really really enjoyed that too,
1144
00:59:12.199 --> 00:59:13.840
so I'll put a link to that in the comments
1145
00:59:13.880 --> 00:59:17.079
as well. But yeah, and then the last pick I have,
1146
00:59:17.760 --> 00:59:22.360
so Valentino mentioned rails World and the stuff that came
1147
00:59:22.400 --> 00:59:25.159
out of it. I haven't watched any of the talks.
1148
00:59:25.239 --> 00:59:27.800
I haven't really dived into what came out of it.
1149
00:59:28.239 --> 00:59:31.840
But I've been using Kamal to deploy my stuff, and
1150
00:59:31.880 --> 00:59:36.360
I've gotten really tired of fighting the traffic reverse proxy
1151
00:59:37.000 --> 00:59:40.480
load balancer, and so I wanted to upgrade to Kamal
1152
00:59:40.559 --> 00:59:43.559
too so I could get the Kmal proxy put in
1153
00:59:44.880 --> 00:59:47.559
and make my life a little simpler. Because it looked
1154
00:59:47.599 --> 00:59:49.559
like it made it would make my life a little simpler.
1155
00:59:50.360 --> 00:59:54.159
And so I did the upgrade, and I kind of
1156
00:59:54.159 --> 00:59:56.039
screwed it up and then fixed it, so it took
1157
00:59:56.079 --> 00:59:57.800
a little longer and a little more work than I
1158
00:59:57.800 --> 01:00:02.599
thought it would. Essentially when I messed up was the
1159
01:00:02.679 --> 01:00:06.840
directions are a little bit The documentation on Camal is
1160
01:00:06.920 --> 01:00:12.639
just not awesome. I'll just put it that way. But anyway,
1161
01:00:12.760 --> 01:00:16.880
what what it does is it uh, it tells you
1162
01:00:16.920 --> 01:00:20.800
to upgrade by upgrading to Comal one nine, one dot nine.
1163
01:00:21.039 --> 01:00:23.559
There's one dot nine dot one now, but I think
1164
01:00:23.559 --> 01:00:25.760
it tells you to do one dot nine dot zero. Anyway,
1165
01:00:27.880 --> 01:00:29.480
you want to make sure that you can deploy with
1166
01:00:29.519 --> 01:00:32.079
one dot nine and then you can upgrade to two
1167
01:00:32.119 --> 01:00:36.880
dot one and do the Camal upgrade. And then it
1168
01:00:36.920 --> 01:00:39.480
goes in and it stops traffic, and it starts the
1169
01:00:39.519 --> 01:00:43.519
Camal proxy, and it, you know, does the let's encrypt
1170
01:00:43.559 --> 01:00:47.039
and all of that stuff for you without having to
1171
01:00:47.079 --> 01:00:49.000
know all of the arcane magic that you need to
1172
01:00:49.000 --> 01:00:50.480
know in order to get traffic to do all that
1173
01:00:50.559 --> 01:00:54.280
for you. And so I'm anyway, I'm pretty excited about it.
1174
01:00:54.280 --> 01:00:57.639
It's it's been pretty awesome so far. So I'm going
1175
01:00:57.679 --> 01:01:01.840
to pick that I got a couple of things I
1176
01:01:01.920 --> 01:01:03.519
still need to figure out on it, because I want
1177
01:01:03.519 --> 01:01:06.159
to do multi tenancy and allow people to pick their
1178
01:01:06.159 --> 01:01:08.960
own domains, and so then I want it to do
1179
01:01:09.039 --> 01:01:11.679
the let's encrypt stuff, and so I'm trying to figure
1180
01:01:11.679 --> 01:01:13.800
out if I can make Kamal do that for me
1181
01:01:15.000 --> 01:01:18.039
or Kamal proxy do that for me without having to
1182
01:01:18.039 --> 01:01:21.760
have it in my configuration. But for now, it's it's
1183
01:01:21.760 --> 01:01:25.320
employing great. So I've been pretty happy. With that, Brian,
1184
01:01:25.400 --> 01:01:26.079
what are your picks?
1185
01:01:27.239 --> 01:01:30.159
Yeah, those are some good picks. Hard to compete with that.
1186
01:01:31.679 --> 01:01:35.039
I think a huge Star Wars fan, so I'll just
1187
01:01:35.039 --> 01:01:36.760
shout out Star Wars clone Wars. I feel like not
1188
01:01:36.760 --> 01:01:38.360
a lot of people know about it, but it's between
1189
01:01:38.400 --> 01:01:41.599
episode two and three, and it's so freaking good. It's like,
1190
01:01:41.840 --> 01:01:44.320
I'm a guy that usually doesn't like like animated stuff,
1191
01:01:44.800 --> 01:01:49.039
and it's just blown me away. So if you're a
1192
01:01:49.039 --> 01:01:51.719
big Star Wars fan, there's a lot of seasons and
1193
01:01:51.760 --> 01:01:54.440
it's insanely good, and it's basically like Dave Filonia at.
1194
01:01:54.360 --> 01:01:55.039
His best.
1195
01:01:56.599 --> 01:01:59.000
Outs of that really big fan of the Perplexity app.
1196
01:01:59.039 --> 01:02:01.239
It's like, basically we're placed any Google Search, as I
1197
01:02:01.280 --> 01:02:04.239
do now for anyone who doesn't know what Perplexity is,
1198
01:02:04.440 --> 01:02:08.559
it's Google such Google Search plus chat GBT is like,
1199
01:02:08.679 --> 01:02:10.519
so ask it a question and it just gives you
1200
01:02:10.559 --> 01:02:12.079
the knowledge back. It doesn't just give you a bunch
1201
01:02:12.079 --> 01:02:14.639
of links and it uses uh and just like a
1202
01:02:14.719 --> 01:02:17.079
Google search, its update in real time, so if something
1203
01:02:17.119 --> 01:02:20.519
comes out yesterday or earlier today, it'll be informed on that.
1204
01:02:21.639 --> 01:02:24.280
And it is just an incredible job at answering, like
1205
01:02:24.440 --> 01:02:27.079
really in depth questions like you can ask it very
1206
01:02:27.159 --> 01:02:29.599
very complicated questions that have a lot of nuance, that
1207
01:02:29.679 --> 01:02:33.320
have a lot of requirements on real time data, like
1208
01:02:33.960 --> 01:02:36.719
I don't know what's the compare the market cap of
1209
01:02:37.039 --> 01:02:40.239
Nvidia to its revenue and then compare that to Microsoft's
1210
01:02:40.440 --> 01:02:42.400
and figure out which one is a better stock to investment.
1211
01:02:42.440 --> 01:02:43.719
Like you can ask that question, I'll give you a
1212
01:02:43.719 --> 01:02:48.840
pretty concrete answer with like charts and graphs included. So
1213
01:02:49.000 --> 01:02:51.000
very impressed with, Like, I think that's like a pretty
1214
01:02:51.000 --> 01:02:53.760
big step up and the ability to like get knowledge
1215
01:02:54.000 --> 01:02:58.960
very very quickly. And then the other one is John Coogan.
1216
01:02:59.320 --> 01:03:01.400
I think he does a it's a YouTube channel he
1217
01:03:01.639 --> 01:03:04.440
that's out there, and he just does an incredible job
1218
01:03:05.000 --> 01:03:09.800
of like talking about I think tricky topics, so like
1219
01:03:09.960 --> 01:03:13.280
what's happening with Taiwan and chips or and or old
1220
01:03:13.559 --> 01:03:15.480
Prime defense. Like he just does a good job of
1221
01:03:15.519 --> 01:03:18.880
telling the story of some event or some company really
1222
01:03:18.920 --> 01:03:22.039
really well, and I feel like it's extremely fact based
1223
01:03:22.079 --> 01:03:27.440
and not like bias based. So I generally go to
1224
01:03:27.559 --> 01:03:30.760
him when I'm looking for like really high impact news breakdowns.
1225
01:03:32.480 --> 01:03:33.800
And then if you're also a Star Wars fan, I
1226
01:03:33.920 --> 01:03:36.119
just done with the skin because again huge Star Wars nerd.
1227
01:03:36.159 --> 01:03:40.559
Here there's a board game called Star Wars Rebellion. It's
1228
01:03:40.599 --> 01:03:42.519
played with two players. One guy gets to play as
1229
01:03:42.559 --> 01:03:45.559
the Empire or the other as the Rebellion and you
1230
01:03:45.559 --> 01:03:48.800
guys battle it off and it's it's quite fun. It's
1231
01:03:49.039 --> 01:03:51.920
a very asymmetric game, but I think that's what makes
1232
01:03:51.960 --> 01:03:54.559
it fun, because like Star Wars is very asymmetric. Uh,
1233
01:03:54.880 --> 01:03:57.199
the Empire had a lot more resources than the rebels.
1234
01:03:58.320 --> 01:04:01.159
But if you like Star Wars but fun wars and that,
1235
01:04:01.159 --> 01:04:04.519
that board game will do you a lot of good awesome.
1236
01:04:04.559 --> 01:04:09.679
I don't think i've played this one. It's it's pretty
1237
01:04:09.760 --> 01:04:12.440
highly ranked on board game Geek. It has a weight
1238
01:04:12.519 --> 01:04:14.639
of three point seventy four, which means it's a pretty
1239
01:04:14.639 --> 01:04:15.519
complicated game.
1240
01:04:15.599 --> 01:04:18.320
Oh yeah, it took us eight hours to figure out.
1241
01:04:19.440 --> 01:04:22.880
Yeah, it says two to four players and the playtime
1242
01:04:23.119 --> 01:04:26.639
is like three to four hours, And I'm assuming that's
1243
01:04:26.639 --> 01:04:27.679
if you know how to play.
1244
01:04:28.800 --> 01:04:31.239
Yeah, I'd say me and my brother we play. It
1245
01:04:31.280 --> 01:04:33.639
took us eight hours the first game to get it.
1246
01:04:33.880 --> 01:04:36.840
The second game, we actually did it across two days
1247
01:04:36.880 --> 01:04:38.840
just because we were kind of like very slow with
1248
01:04:38.880 --> 01:04:41.320
every decision and be really methodical and now we'll play
1249
01:04:41.360 --> 01:04:43.000
like in an hour and a half. So like it,
1250
01:04:43.280 --> 01:04:45.079
once you get comfortable, rams up pretty quickly.
1251
01:04:46.360 --> 01:04:52.199
Yeah. But yeah, so the rank on it overall is nine,
1252
01:04:52.559 --> 01:04:56.920
So it's the ninth most popular game on board game geek.
1253
01:04:57.440 --> 01:04:58.199
Hey there we go.
1254
01:04:58.760 --> 01:05:02.840
Yeah, and it's it's the fifth thematic, which means that
1255
01:05:02.880 --> 01:05:05.480
it has some you know, some theme to it, like
1256
01:05:05.760 --> 01:05:10.639
Star Wars. So yeah, so next time I'm at a
1257
01:05:10.639 --> 01:05:13.840
board game convention maybe I'll see if they have it,
1258
01:05:14.440 --> 01:05:18.960
if I can play it. Anyway, I'm a board game
1259
01:05:19.000 --> 01:05:20.320
that I really enjoy that stuff.
1260
01:05:20.360 --> 01:05:23.320
So it's all right a lot of fun.
1261
01:05:23.880 --> 01:05:26.639
Yeah. So, Brian, if people want to connect with you online,
1262
01:05:26.639 --> 01:05:27.400
how do they find you?
1263
01:05:28.199 --> 01:05:31.599
Brian at dopper dot com for email that will long
1264
01:05:31.599 --> 01:05:35.480
get Brian for LinkedIn and twin Cool.
1265
01:05:36.239 --> 01:05:39.719
All right, well thanks for coming, yeah, thank you. All right,
1266
01:05:39.800 --> 01:05:46.360
until next time, folks, max out