Speaker 1: Here we go, Warren, how are you just jumping right
Speaker 1: into those personal questions?
Speaker 2: I know right who? I can't remember who the guest was.
Speaker 3: We had a guest on it was earlier this year,
Speaker 3: and I asked her because we do like a little
Speaker 3: prep before we start recording, and I say, you know,
Speaker 3: there's no like stumped chump questions. Everything should be laid
Speaker 3: back in conversational. And I asked her how she was
Speaker 3: doing and she's like, I thought you said there would
Speaker 3: be no hard questions.
Speaker 2: I was like, oh my bad.
Speaker 1: I had the right answer here. Actually, I was planning
Speaker 1: for this the whole day and then you went and
Speaker 1: you asked me, and I totally forgot what it was
Speaker 1: that I was going to say here, So.
Speaker 2: You know, thanks for that.
Speaker 3: Yeah, yeah, that's that's why I'm here, joining us back
Speaker 3: after a long break. And she just dropped offline. I'll
Speaker 3: just foreshadow it. Jillian is back as a co host
Speaker 3: on the show, but she's had audio issue, so she'll
Speaker 3: be joining us later in the episode, but then also
Speaker 3: joining us today as our special guest, Brian valaalonga from Doppler.
Speaker 2: Brian, how are.
Speaker 4: You I'm doing well? Great to be here, dude.
Speaker 3: I'm excited to have you looking forward to this conversation
Speaker 3: because we're going to be talking about secrets management, which men,
Speaker 3: there's so many different ways to deal with that, so
Speaker 3: I'm excited to hear what your take on that is.
Speaker 3: But before we get into that, could you give our
Speaker 3: listeners a little bit about your background and how you
Speaker 3: got to this point in your life.
Speaker 4: Yeah?
Speaker 5: Sure, So, I mean, I've always been a founder at
Speaker 5: Hearts Dopplers. I think startup number eight or nine. It's
Speaker 5: been quite a journey, a lot of a lot of
Speaker 5: companies that now looking back probably feel more like projects.
Speaker 4: But yeah, a lot of failures along the way. So
Speaker 4: I'd say is just don't give up.
Speaker 5: But I think for me, where Topla really got started
Speaker 5: was I was working and I was working on a
Speaker 5: side project at the time while I was at uber
Speaker 5: in my free time, and it was a crypto machine
Speaker 5: learning marketplace, kind of like all the buzzwords in one
Speaker 5: and I could not funding was guaranteed, right, you would think,
Speaker 5: and you would think that customers were guaranteed. But turns
Speaker 5: out I was just a little too early and none
Speaker 5: of that was guaranteed at all. If anything, it was
Speaker 5: really freaking hard to get it off the ground. I
Speaker 5: felt like pushing a boulder up a hill. You move
Speaker 5: one foot forward and slipped five feet back from exhaustion.
Speaker 4: It just sucked.
Speaker 5: And which is funny because like, now there's a company
Speaker 5: today that just like is enormously successful doing like ninety
Speaker 5: nine percent of what we did. But that's just how
Speaker 5: it works, Like you gotta time it correctly, and we didn't.
Speaker 5: But yeah, I was working on that for a long
Speaker 5: time and I was just getting frustrated, and so I
Speaker 5: realized at some point I was never going to be
Speaker 5: able to get this thing off the ground, and so
Speaker 5: I started looking at the proms I was facing while
Speaker 5: running it and managing environment variables, API keys, database URLs,
Speaker 5: and other sensitive information that typically is used to like
Speaker 5: can figure an application, like I kept struggling with it
Speaker 5: felt really weird to share with the contractor. At one
Speaker 5: point in time, it's like, oh, are they gonna walk
Speaker 5: away with my crypto keys that I can't like really change,
Speaker 5: and then all the customers are relying on us to
Speaker 5: keep securely and then like we drop crypto one point,
Speaker 5: and we were using like Stripe for pay and processing,
Speaker 5: and we had the stripe production key in staging the
Speaker 5: Stage one and PROD and took us a month to
Speaker 5: realize why we weren't doing any transactions. So we were
Speaker 5: up in an operational and could not do a transaction,
Speaker 5: and it took us so long to figure that. It
Speaker 5: was just like so many of these like like face
Speaker 5: palm moments where it's like, damn that that sucked.
Speaker 4: And so I.
Speaker 5: Go back to I go back to this in San Franisco,
Speaker 5: to this dinner that had a whole bunch of founders
Speaker 5: and developers, and I'm like, hey, am I a shitty engineer,
Speaker 5: is a world broke? And I just can't tell anymore.
Speaker 5: You tell me real problem. And they were like, yeah,
Speaker 5: this is a real problem. We're all struggling with the two.
Speaker 5: And that's what kind of got us started. And after
Speaker 5: that we started building the MVP, which took a couple
Speaker 5: of weeks, and on the fourth week we got some
Speaker 5: set of customers and then we were off the races
Speaker 5: right on.
Speaker 3: I mean, that's a quick turnaround to have to be
Speaker 3: onboarding customers on your fourth week.
Speaker 5: Oh yeah, we were. We were like, speed is the
Speaker 5: only thing that gives us a permission to survive here
Speaker 5: these not We're going to get slaughtered, And so we
Speaker 5: just moved incredibly quickly, like there were many many days
Speaker 5: with no sleep. I mean, Doppler was you was our
Speaker 5: we were the first customer of our own product. Before
Speaker 5: we even had a dashboard in a UI. We would
Speaker 5: just only use it with the with the API, and
Speaker 5: whenever I needed to change secrets, I would literally go
Speaker 5: into the database and edit the secrets before the h
Speaker 5: the encryption step.
Speaker 2: So it's like, right on, that's awesome.
Speaker 3: So just to put things in context, you kind of
Speaker 3: hinted to it, but let's clarify what we mean by secret.
Speaker 3: You mentioned, you know, API keys, database, URL's passwords. Obviously,
Speaker 3: what kind of things fall into the scope of secrets management.
Speaker 4: Yeah, this is a great question.
Speaker 5: I generally recommend it's anything that configures the application, and
Speaker 5: I know that can go even into a little bit
Speaker 5: of extreme, Like some people on the call could be like,
Speaker 5: what about my port? Is my port really a secret?
Speaker 5: And my answer here would be yes. And the reason
Speaker 5: why is because if you have to start making a
Speaker 5: decision about what's a secret and what's not, then you're
Speaker 5: you could be wrong. And the one time you're wrong.
Speaker 5: That could lead to the company dying or some like
Speaker 5: crazy event happening. So instead, I say, my view is,
Speaker 5: anytime you're configuring an application with a variable of some type,
Speaker 5: an a pike or poor to a logging statement, whatever
Speaker 5: it is, treat all of it the same and treat
Speaker 5: it all as the most sensitive thing possible. That way,
Speaker 5: you're kind of offloading this decision making and you're saying, Okay,
Speaker 5: we're just gonna do the most cure thing by default,
Speaker 5: and so we're reducing our chances of a bat event
Speaker 5: happening by by what every engineer now kind of like
Speaker 5: randomly deciding what's a secret and what's not.
Speaker 3: That's a good point because I think that adds to
Speaker 3: a lot of the complexity I've had managing secrets in
Speaker 3: the past, is defining Okay, we do our configure variables
Speaker 3: over here, but then our secrets you're over here. And
Speaker 3: you've just in hindsight now that you said that, I
Speaker 3: just doubled my workload for really no no real good reason.
Speaker 5: And usually they end up being like two completely different systems,
Speaker 5: and so now it's even harder to track of like
Speaker 5: which one to one in which system it's not like
Speaker 5: it's like there's like a branching point that you like
Speaker 5: can like track that and have a review around it.
Speaker 4: And so a lot of times now you're just hoping.
Speaker 5: And praying every engineer in the company kind of just
Speaker 5: makes the right decision at all times, which, like we're
Speaker 5: all humans, We're most like at some point in time,
Speaker 5: someone is going to make a mistake. The problem is
Speaker 5: that mistake could cost the company big time and.
Speaker 4: All of its users.
Speaker 1: Yeah, so a really important point there, I think is
Speaker 1: not really worth like really worth diving into for a second.
Speaker 1: So I really like this topic because I actually have
Speaker 1: a conference talk that I've been doing for a couple
Speaker 1: of years now specifically about teaching about secrets management and
Speaker 1: all the different strategies out there, and there's like quite
Speaker 1: a few of them. Secrets manager, the cloud providers have
Speaker 1: key management services, there's like open source faults and whatnot.
Speaker 1: And the sad story is the only real strategy that
Speaker 1: works in theory is something like bring your own keys,
Speaker 1: where things are secured by default, and the number of
Speaker 1: providers out there that support that, Like I know we
Speaker 1: do at authors like let our customers bring our own keys,
Speaker 1: like the number of customers out there that are working
Speaker 1: with a provider, even like something as important as Strife
Speaker 1: or even some of the cloud providers, they don't support that,
Speaker 1: Like you can't bring your own keys to any of
Speaker 1: those critical systems. It's sort of ridiculous that this is
Speaker 1: the world we live in of only bad options are available.
Speaker 4: Yeah, it is.
Speaker 5: I mean I would say, like where we really now?
Speaker 5: I agree with you that it's really we're living in
Speaker 5: a world of bad options. Doppler tries to and obviously
Speaker 5: I'm biased because I found Adoptler. I'll just call that out,
Speaker 5: but like I think that just so anyone knows, but
Speaker 5: I do think that, like you can get to a
Speaker 5: pretty good state.
Speaker 4: And then I would say where the.
Speaker 5: World's going in a second, one I can talk about
Speaker 5: is like the ideal state, but at least a Doppler.
Speaker 5: We went through a lot of iterations, like we rebuilt
Speaker 5: the product from scratch like three times, and what we
Speaker 5: realized is that you're never gonna be able to get
Speaker 5: developer ad option unless you make vegetables taste like candy
Speaker 5: and vegetables being the security can you be in the
Speaker 5: developer productivity.
Speaker 4: Developers are never gonna use it.
Speaker 6: Developers are children in this scenario because it.
Speaker 4: So right, but yeah, you gotta, you gotta. It's it's
Speaker 4: really around like are are you taking energy from them?
Speaker 5: You giving them energy in a way, right, Like developers
Speaker 5: want to stay and flow state. They want to be
Speaker 5: super productive, and if you can help them be more productive,
Speaker 5: if you can give them like a tailwind, then they
Speaker 5: will love your tool and they'll use it regardless of
Speaker 5: the security benefits. But if you give them headwinds, well
Speaker 5: they're gonna run away from you because they don't like that, understandably.
Speaker 5: And so for us, that was our trick to making
Speaker 5: it a tool that developers truly loves. The company gets
Speaker 5: security benefits is give them about two hours a week
Speaker 5: of productivity games and there's a whole host of ways
Speaker 5: we do that. We don't have to get into that
Speaker 5: on this call, but like that was the fundamental reason
Speaker 5: that I think doubt war has become somewhat successful in
Speaker 5: helping developers want to manage their secrets better. It's not
Speaker 5: about forcing them to, it's about getting them to want
Speaker 5: to do it. And then I think I mentioned before,
Speaker 5: like where it's going in the ideal state, we're moving
Speaker 5: to this world of like identity based seek, like identity
Speaker 5: based authentication. And so the idea here is like with
Speaker 5: like we have something like pass key, where like you
Speaker 5: can scan your fingerprint or scan your face and get
Speaker 5: into another system with just your email address and that
Speaker 5: like fingerprint or that face ID, and that's called passkey.
Speaker 5: It's getting rolled out across like all these major sites today.
Speaker 5: That's gonna start happening with secrets like API keys. Instead
Speaker 5: of having this API key, you'll have like this identity
Speaker 5: and so the fact that you're on your laptop or
Speaker 5: in an AWS cluster, you'll automatically be authenticated to stripe
Speaker 5: in the future. And that's like a really powerful thing.
Speaker 5: And my guess is it will be like a little
Speaker 5: bit difficult to set up without like a proper secrets
Speaker 5: manager like Doppler, But once it is set up, it'll
Speaker 5: be seamless, like you're just in the machine and it
Speaker 5: just works. You're automatically authenticated and there's nothing else you
Speaker 5: need to do, and there's now no worry about actually
Speaker 5: losing this secrets, which can cause a breach or anything
Speaker 5: like that.
Speaker 4: It'll just be secured by default.
Speaker 3: Yeah, for sure, So that scenario sounds to me a
Speaker 3: lot like or like very similar to the open id
Speaker 3: connect platform. We use that a lot with our GitHub integration.
Speaker 3: So the way that works for anyone who's not familiar
Speaker 3: with it is GitHub. When your GitHub action runs, it
Speaker 3: sends an authenticated request to your AWS environment. ABS validates
Speaker 3: that request, and then issues back a temporary set of
Speaker 3: credentials tied to a specific role that has been set up.
Speaker 3: So now your GitHub action has permissions inside your AWS
Speaker 3: account to do only the things that are permitted by
Speaker 3: that role and only within the timeframe set by those
Speaker 3: keys that were issued to it. And it is a
Speaker 3: pain in the pain and he has to set up,
Speaker 3: but like, once it's set up, it's so seamless and
Speaker 3: smooth and you never have to you never have to
Speaker 3: lie to your security guys and say, oh, yeah, we
Speaker 3: rotated the keys.
Speaker 2: Absolutely.
Speaker 1: I really liked that you brought this up, actually, because
Speaker 1: the canonical name that you called it was open id connect,
Speaker 1: which isn't wrang and the like GitHub and AWS jumped
Speaker 1: on oi DC as the acronym for it for making
Speaker 1: this work, and that's not what open idconnect is at all,
Speaker 1: but that's what all these providers are calling it the
Speaker 1: canonical term ridiculously is actually known as workload identities, and
Speaker 1: they're sourced from the some trusted location. So in this case,
Speaker 1: you're having your aw's account trust GitHub as a source,
Speaker 1: and then your workload is getting its own temporary identity
Speaker 1: which can authenticate to your cloud profighter. And yeah, for Charlotte,
Speaker 1: this is the dream come true of bring your own keys.
Speaker 1: Workload identity is being able to be passed from wherever
Speaker 1: you're running to whatever the third party application is that
Speaker 1: you're integrating with without ever needing to do anything else
Speaker 1: other than potentially sharing a public key exchange, because I
Speaker 1: think that's still going to need to be a manual
Speaker 1: step by everyone involved.
Speaker 2: How does that line up with the future as you
Speaker 2: see it, Brian.
Speaker 4: It's very close. I think we need some.
Speaker 5: Player, and I think Doppler is going to be that
Speaker 5: middle player that kind of acts as like the network
Speaker 5: highway for everyone. So I'll give you an example. Let's
Speaker 5: just say you're an AWS. We're gonna make it super
Speaker 5: seamless to be connected from AWS to Doppler, and so
Speaker 5: anytime you're in AI of US, you're automatically authenticated to
Speaker 5: Doppler with all the right roles, permissions and all that stuff.
Speaker 5: And then you're gonna also want that because you're a
Speaker 5: Doppler to be connected automatically to Stripe, to Twilia, to
Speaker 5: your database, to the ten thousand other services you're using.
Speaker 5: And so now you're gonna get this beautiful world where
Speaker 5: you don't have to configure all these individual relationships painfully
Speaker 5: in AWS. Instead, you'll set up one relationship with Doppler,
Speaker 5: and then Dopper will kind of give you a seamless
Speaker 5: way to like manage the rest, and so you kind
Speaker 5: of get this like one to one and then one
Speaker 5: to many. Right, So, the fact that you're an a
Speaker 5: of us, you're not authenticated Dopper, which means you're authenticated
Speaker 5: to Stripe, and it all just kind of like works
Speaker 5: seamlessly in the background, like Dopper kind of like fades
Speaker 5: away and it's like just opera and completely in the
Speaker 5: shadows and giving you that authentication to all the services
Speaker 5: that you care about. And that's kind of like the
Speaker 5: world we see ourselves playing in in the future.
Speaker 2: Right on what.
Speaker 6: You know, did anybody like ever use party lines or
Speaker 6: anything when they were a kid and you'd have to
Speaker 6: call it and they would direct you to where you
Speaker 6: needed to go. And then in the background, you know,
Speaker 6: like the nosy neighbor would be listening in on just
Speaker 6: everybody's call and would know everything that was going on.
Speaker 1: That nosyas nosy neighbor was my grandma. She was always
Speaker 1: on their listening.
Speaker 6: Yeah, I had I had some mounts like that too.
Speaker 6: They always knew what was up. And let's stop for
Speaker 6: Doppler knows what's up too.
Speaker 5: We try as hard as possible not to know what's
Speaker 5: upment you're looking for.
Speaker 2: Right, Nice save Brian Nice.
Speaker 5: I think in like reality, we we'll end up thing is
Speaker 5: like we will like offload the like we'll giving because
Speaker 5: while the relationship with Stripe or any of these services,
Speaker 5: it'll all just get encrypted at the end day, and
Speaker 5: we'll just try to make sure that we set up
Speaker 5: the encryption in a way that we can't possibly like
Speaker 5: read the output of because I like, for everyone's benefit,
Speaker 5: we don't want to be able to see that data.
Speaker 1: Yeah, I mean, I think the biggest problem today is
Speaker 1: that those serve, those products, those applications that you really
Speaker 1: want to have protected, have some of the worst security
Speaker 1: and ever. Like you used to Wripe as an example,
Speaker 1: and I'm not it's not the worst one there is,
Speaker 1: but you can't even like I can't even get SSO
Speaker 1: to work with Stripe, like they they don't support it anymore.
Speaker 1: Like literally Stripe does not support SSO, And I'm just
Speaker 1: like how, like why not? Like I want that to
Speaker 1: be integrated into my into my seam system. I want
Speaker 1: to be able to authenticate there and have two factor
Speaker 1: off through whatever provider I'm utilizing, and it doesn't support it,
Speaker 1: so like they don't even support that baseline. So I
Speaker 1: have very little faith that in the very near future
Speaker 1: strife will support workload identities to.
Speaker 7: Be able to prove that. But I mean, if we
Speaker 7: get there, that would be great.
Speaker 1: So far, the number of providers that really support this
Speaker 1: is just absolutely minuscule.
Speaker 5: So I have two thoughts around that, because we put
Speaker 5: a lot of time into thinking about like how do
Speaker 5: we get the community to My gut reed on what's
Speaker 5: going to happen is eventually there's gonna be an open
Speaker 5: protocol that everyone can.
Speaker 4: Like adhere to that's like pretty easy to use.
Speaker 5: Probably they'll be like SDKs and all the popular languages,
Speaker 5: and then some company or a band of secret spanagement
Speaker 5: companies are going to put out a leader board and
Speaker 5: they're going to show all the companies that do support it.
Speaker 5: It will be kind of like the SSO tax website,
Speaker 5: and you kind of just like want to be on
Speaker 5: that list or don't want to be on that list,
Speaker 5: depending on how it's structured. And my hope is that
Speaker 5: like that will create enough peer pressure. And then on
Speaker 5: top of that, I'm only.
Speaker 4: A bet a lot of money that, like as.
Speaker 5: AI gets more and more sophisticated and can go from
Speaker 5: like being a co pilot to like a full blown engineer,
Speaker 5: like AI engine years and I'm talking about humans that
Speaker 5: are using AI to engineer. I'm talking about an AI
Speaker 5: that is fully capable of being an engineer. Those those
Speaker 5: AI agents are going to want identity based authentication and
Speaker 5: they will push aggressively for it, and I bet that's gonna,
Speaker 5: like those two things together will probably lead over time
Speaker 5: to like all the big players eventually like doing this
Speaker 5: just because they have to.
Speaker 1: I love your optimism, Like it's just it's just so great.
Speaker 7: I mean, because like today we see so many.
Speaker 1: People putting credentials in plain text, let alone whatever else
Speaker 1: we're going to call a secret, So getting them to,
Speaker 1: you know, go down a different path is a huge
Speaker 1: challenge there. And the other problem is like there is
Speaker 1: a bit of a standard already around the providers where they.
Speaker 5: Can use it.
Speaker 1: I think everyone could stand up any sort of open id,
Speaker 1: but it doesn't give them a lot of like, it
Speaker 1: doesn't give them money, like, it doesn't help the businesses
Speaker 1: grow to support that as an optional. Less some bigger
Speaker 1: players as yeah, we like, if you want us to
Speaker 1: use you, you have to support this. And I think
Speaker 1: the great example of that is you brought up a
Speaker 1: SSO tax, which I think does the wrong thing. I
Speaker 1: feel like it's positive reinforcement for all these companies that
Speaker 1: do the wrong thing. I see this leaderboard of all
Speaker 1: these companies, and now I read that name, and is
Speaker 1: there something known in psychology is called preferential attachment. I
Speaker 1: see this company listed there, and I forget why, Like
Speaker 1: I don't remember SSO tax and you remember the name.
Speaker 1: And then months later I got a call from one
Speaker 1: of their terrible salespeople trying to harass me on my
Speaker 1: personal phone number, saying, hey, do you want to buy
Speaker 1: our product? But I heard that company name before, so
Speaker 1: now I'm tempted to actually buy their product. Even then,
Speaker 1: the reason I know about them is because they were
Speaker 1: listed on a site that says they did the wrong thing.
Speaker 1: We see the same thing happen with vulnerabilities and data leaks.
Speaker 1: You learn about companies because they had a data leak,
Speaker 1: and that just actually enforces how great they must be,
Speaker 1: because then they send out those emails thing, oh, we're
Speaker 1: committed to security, we're going to change things and uh,
Speaker 1: and that gives you. That gives you some confidence in
Speaker 1: this particular company. So I think there's a special message
Speaker 1: that has to be sent that actually does the right thing.
Speaker 1: Having a group of standards can work, But if the
Speaker 1: companies haven't taken it on themselves to actually implement these,
Speaker 1: I don't like. I don't see magically that it's going
Speaker 1: to happen in the next ten years.
Speaker 5: Maybe another way to I mean I used to think
Speaker 5: the same thing about Pasky's, but now it's getting rolled out.
Speaker 5: So but on the flip side, also, this could be
Speaker 5: a place where like war compliance comes in, like they
Speaker 5: added to the compliance bodies of like if you issue
Speaker 5: out secrets, you have to you have to support these methods.
Speaker 3: So let's take a quick step back and talk about
Speaker 3: like what are some of the other common strategies that
Speaker 3: you've seen for managing secrets, just to help people put
Speaker 3: into perspective or like recognize themselves as owners of this
Speaker 3: problem even though they may not recognize themselves as that
Speaker 3: group yet.
Speaker 4: Yeah.
Speaker 5: So typically the way I see it is they're coming
Speaker 5: from a couple of different worlds. One is they're using
Speaker 5: something called an eb file or like a plane piece
Speaker 5: of text file that has a whole bunch of secrets
Speaker 5: on it. That's bad for a number of reasons. One,
Speaker 5: those secrets are unencrypted on disc, so like they're very
Speaker 5: easy to like steal. Two, they are now shared in
Speaker 5: insecure ways like slack an email, again another breach point
Speaker 5: that can happen. And three the manua to be coordinated.
Speaker 5: Like imagine if you have a ward doc and I
Speaker 5: have a ward dooc and everyone else on the team
Speaker 5: has the same wartock and we're all editing in real
Speaker 5: time before Google docs or Notion, and we have to
Speaker 5: all keep it in sick.
Speaker 4: That's like quite hard.
Speaker 5: So another thing we see is like they're only using
Speaker 5: cloud providers, which generally works for production, but then they're
Speaker 5: using like eethos eb files for development, and like where
Speaker 5: the problem really gets bad is like they can't answer
Speaker 5: these like fundamental four questions. The first question is like
Speaker 5: do I know where all my secrets are?
Speaker 4: These?
Speaker 5: You cannot possibly protect your secrets unless you know where
Speaker 5: all of them are.
Speaker 4: Do I have a point? Right?
Speaker 5: Do I have the ability to like access control these
Speaker 5: secrets because if you can't put permissions around them, again,
Speaker 5: you can't protect them. Very hard to do that when
Speaker 5: everyone's just sharing files back and forth. There's no real
Speaker 5: permission model.
Speaker 6: There, right?
Speaker 4: Three?
Speaker 5: Do I have logging and auditing around every action that's taken,
Speaker 5: including reads?
Speaker 2: Right?
Speaker 5: Do I know every time someone has read a secret
Speaker 5: from development of production and everything in between? You'd be
Speaker 5: surprised how many times production credentials and then end up
Speaker 5: in a development environment. Right, So you need a tract
Speaker 5: development too, Like you'll see this all the time where
Speaker 5: like developers like, oh productions having an outagy, I'm just
Speaker 5: gonna like create myself with produt E and v file
Speaker 5: and test production locally real quick. Now you got proud
Speaker 5: secrets on your laptop, what are you gonna do?
Speaker 4: Like?
Speaker 5: And then the last one is when you do have
Speaker 5: a data breach because something went bad, can you stop
Speaker 5: it very quick and very quickly in the orders of
Speaker 5: like minutes, Like if you think about how fast data
Speaker 5: can leave your system, right, like data can leave your
Speaker 5: system like bigabits per second right from a tows, Well
Speaker 5: that's the case.
Speaker 4: A couple of minutes of.
Speaker 5: A data breach is actually a really really big deal
Speaker 5: at this point, ours is like an like disastrous. And
Speaker 5: so if you can't answer those four questions confidently, not
Speaker 5: like oh yeah, I can run a piece of paper,
Speaker 5: but like I am extremely confident I've bet my job
Speaker 5: in my life on these on answering these questions. Confidently
Speaker 5: you have a problem and now it's on you to
Speaker 5: fix it.
Speaker 3: I like that, that's pretty clear cut. I will not
Speaker 3: go on record answering those questions.
Speaker 6: Definitely be my life there, Like I.
Speaker 1: Think maybe much for me, I mean since I since
Speaker 1: I guess that leaves me and uh. I run a
Speaker 1: technology company that focuses on providing log in and access
Speaker 1: control for applications that our customer is right, and so
Speaker 1: I feel like secrets is super important for are both
Speaker 1: us and are our customers there? And we're pretty extensively
Speaker 1: using complex crypto and things like key Management Services KMS
Speaker 1: and AWS and some of the other cloud providers to
Speaker 1: do that at location, that site based encryption there, and
Speaker 1: I definitely don't trust a lot of people to get
Speaker 1: that even close to correct.
Speaker 4: Yeah, it's hard.
Speaker 5: It's really really hard, especially if you're like building I
Speaker 5: found that if like again, you got to you gotta
Speaker 5: get the productivity part, like if you got to make
Speaker 5: it super simple and easy to use, where there's no
Speaker 5: footgun moments, you can't shoot yourself on the foot The
Speaker 5: default easy path has to be the right path. And
Speaker 5: that's that's probably like the hardest part that I found
Speaker 5: with building this. It's like, at the end of day,
Speaker 5: at least for us, it didn't feel like building the
Speaker 5: tool that was secure was a hard park. It was
Speaker 5: like at our frontish foundational level of like the infrastructure layer,
Speaker 5: but building it so that the end the end user
Speaker 5: experience to the developer being secured by default, that part
Speaker 5: was actually really hard to get right because also because
Speaker 5: like every developer has like a differences in mind, and
Speaker 5: so like now you have to like support like a
Speaker 5: very wide variety of different setups and they all have
Speaker 5: to be secured by default, and the most secure thing
Speaker 5: has to be the default thing, and so like talking
Speaker 5: a little bit about like what a solution would look like,
Speaker 5: even if you're not gonna use you don't have to
Speaker 5: use Doppler. That's not my job here is to like
Speaker 5: sell you guys on that. My job here is to
Speaker 5: sell you guys on the problem, and then you guys
Speaker 5: should go solve the problems so we don't keep having
Speaker 5: data breaches because the.
Speaker 4: Number is only rising. It's rising fast. It's like like
Speaker 4: a high growth stock right now.
Speaker 5: What you need is you need a service that centralizes
Speaker 5: or a system that centralizes all your secrets in one.
Speaker 4: Place that's encrypted, super super important.
Speaker 5: You need a system that does not encourage secrets to
Speaker 5: be on disc so you're reading and if you're reading
Speaker 5: from the environment, you immediately clean that up from the
Speaker 5: environment after your like frameworks and libraries at booted up.
Speaker 5: You need a service that has access controls and auditing
Speaker 5: built in, with a really strong audit story there. Ideally
Speaker 5: can also push those logs into a centralized logging platform
Speaker 5: like data Dogs, Blowing and Zeo Logic so you can
Speaker 5: do more robust analysis on it.
Speaker 2: Set up learning, you.
Speaker 5: Need the ability to automatically push the secrets when they
Speaker 5: change into your infrastructure, so there can't be a human
Speaker 5: step involved, or like, let me file your ticket and
Speaker 5: wait three weeks for this ticket to get closed, because
Speaker 5: your code's going to get rolled out automatically. So by default,
Speaker 5: even without the security problem, you have an outage guaranteed
Speaker 5: because you have this race condition of a human filing
Speaker 5: fulfilling a ticket versus GitHub automatically rolling that out to
Speaker 5: AWS or your infrastructure. Right, they're like one's going to
Speaker 5: move a lot faster than the other in the order
Speaker 5: of like seconds versus like days and weeks. So you
Speaker 5: have to have it automatically rolled out, just like your
Speaker 5: code is. And ideally it has to be rolled out
Speaker 5: before your code does, so your code has it to
Speaker 5: consume when it boots up. And the last thing is
Speaker 5: you've got to be able to rotate your credentials, either
Speaker 5: automatically or manually very quickly. If you have a data breach,
Speaker 5: you cannot learn how to firefight and firefight at the
Speaker 5: same time.
Speaker 4: It's too slow. You have to have like your procedures down.
Speaker 5: If you know what buttons you're gonna click, and you're
Speaker 5: gonna have to know how fast it takes you and
Speaker 5: if you're if the data breach happens and you're going
Speaker 5: to take minutes to hours to solve this.
Speaker 4: Problem, you are in a really really bad spot. So
Speaker 4: you can do those things.
Speaker 5: Whatever tool you use, you'll be in good shape or
Speaker 5: anythink I missed anything, uh.
Speaker 1: Not at all, actually, but the thing that came to
Speaker 1: mind is like I'm wondering about. The corollary is like,
Speaker 1: you know what other solutions are there that are out
Speaker 1: there where you're playing in the same space, and I'm
Speaker 1: trying to understand like whether or not it's closer to
Speaker 1: say a secrets manager that one of the cloud providers offer,
Speaker 1: or open Bow or hashing corpus Vault are say you
Speaker 1: know your competitors or whether or not there's something specific here.
Speaker 5: Yeah, So with the secrets managers from the cloud providers,
Speaker 5: those are actually partners of ours. So almost all of
Speaker 5: our customers are using a TOUS secrets manager and Doppler
Speaker 5: and kind of like the the mental model there is
Speaker 5: kind of similar to GitHub or get lab or developer
Speaker 5: pulls their code down, changes it on their laptop, then
Speaker 5: pushes it back up and then one it's ready to
Speaker 5: get released to production then get hub or will then
Speaker 5: push it to AWS, which has its own repository store, and.
Speaker 4: That gets deployed. Dopper does the same thing.
Speaker 5: We'll like allow you to pull those secrets down, change them,
Speaker 5: and then when you're ready to push them up into production,
Speaker 5: we will push it to a to B secrets manager
Speaker 5: or its pramer store or whatever, using on as your GCP,
Speaker 5: and then that will then push it into your infrastructure.
Speaker 5: And so it's kind of like the same model there.
Speaker 5: So we are very closely partnered with the cloud providers
Speaker 5: and most infrastructure companies we support, like I think forty
Speaker 5: different infrastructure companies right now, and then on the like
Speaker 5: even Kubernetes resupport, which is in the company. It's an
Speaker 5: open source initiative, but we support that pretty extensively too,
Speaker 5: And then on open VOW, I would say we're more
Speaker 5: closely competitive, but I would argue that it really solves
Speaker 5: different problems than we do, Like we're looking specifically to
Speaker 5: solve secrets regarding API keys, database riels, and other things
Speaker 5: that configure your application. I would say open Bow is
Speaker 5: more like a generic key store and like you can
Speaker 5: put anything sensitive in it, like a photo of a passport,
Speaker 5: or social Security number or some medical records, not things
Speaker 5: that are like deeply connected to your application and your infrastructure.
Speaker 5: I would say they're missing a lot of the layers
Speaker 5: going back to that, like make vegetables tastes like candy.
Speaker 5: They squarely have the vegetables, but there is no candy involved,
Speaker 5: and without the if, you're not really solving the problem.
Speaker 5: And so I would say it's kind of like Dropbox
Speaker 5: versus Amazon S three. They both do storage, but like
Speaker 5: like one is like here's some APIs, go figure out
Speaker 5: what to do with it. The other is like a
Speaker 5: whole end end experience. It makes it super easy to
Speaker 5: securely store managed secrets. And that's where I think we
Speaker 5: fit in. So while they're competitive, i'd say we're almost
Speaker 5: operating in different market, so like we don't really see
Speaker 5: as hyper competitive.
Speaker 2: That makes sense.
Speaker 3: One of the things you keep coming back to that
Speaker 3: I really like, it really resonates with me, is making
Speaker 3: the vegetables tastes like candy and making the right thing
Speaker 3: the default thing. I just think that works so well
Speaker 3: because like your target customers, not just yours for Doppler,
Speaker 3: but like mine at my organization. You know, I support
Speaker 3: the engineering teams, like I try to put in just
Speaker 3: guardrails so that they can do whatever they need to
Speaker 3: do to get their job done. But then I've got
Speaker 3: guardrails in place so they don't accidentally do something that
Speaker 3: they didn't want to do, and so they by default
Speaker 3: they end up doing the right thing even when they
Speaker 3: don't know what the right thing is.
Speaker 2: And I think that's so important to.
Speaker 3: Get to get that right to have adoption so that
Speaker 3: you don't have to add this extra layer of technical
Speaker 3: expertise and competency on your developers to do the job
Speaker 3: that you hired them for.
Speaker 5: One hundred percent agree, Like I would assume like almost
Speaker 5: every developer you're going to hire is coming with positive intent.
Speaker 5: They want to do a great job. They want the
Speaker 5: company to be secure, they want it to be successful.
Speaker 5: But a lot of times if you force the question
Speaker 5: on the if you force them to answer the question
Speaker 5: of like is it secure, is it's not? What's the
Speaker 5: best way to secure this? They may not get to
Speaker 5: the right answer just because they don't have that expertise.
Speaker 5: And so it's important to kind of like abstract that
Speaker 5: all way. And developers love abstraction. They love SDKs and
Speaker 5: frameworks this is just another one that just equals security. Right,
Speaker 5: So yeah, one hundred percent agree with you. I think
Speaker 5: one thing we haven't chat about that is worth calling
Speaker 5: out is like why should we care? Like why is
Speaker 5: everyone on the call? Why should they care about keep
Speaker 5: being the secret secure? And I know we've talked a
Speaker 5: lot about data breaches for companies, but a lot of times,
Speaker 5: for me at least, it feels like the company has
Speaker 5: a data breach and they get a slap on the wrist, right,
Speaker 5: they get some fine that they can pay with like
Speaker 5: one day worth of revenue. They maybe get a bad
Speaker 5: press article that turns into a good press press article
Speaker 5: later in their minds, as Warren was talking about earlier,
Speaker 5: because now they remember the name, and but like, what
Speaker 5: is the actual real impact here? Because that doesn't sound
Speaker 5: like a lot of negatives right there. That almost sounds
Speaker 5: like not that bad. And I think the real risk
Speaker 5: is actually to the users. Like it's it's so easy
Speaker 5: to forget that every time that we talk about like
Speaker 5: gigabytes or terabytes of data, we're talking about usually people's data,
Speaker 5: like real people to your customers, and they are trusting
Speaker 5: you to keep their data private, like to keep their
Speaker 5: private data private and when that when that breach happens,
Speaker 5: you're breaching their trust because that private data becomes public
Speaker 5: and there's real consequences to that.
Speaker 4: I actually have a real personal story that scared this
Speaker 4: shit out of me.
Speaker 5: I just moved to Austin for anyone who cares, and
Speaker 5: I took my mom out to some barbecue and while
Speaker 5: we were there, I got this call. And the call
Speaker 5: it was from someone who claimed to be at the
Speaker 5: Texas Customs and Borders and they called me and say, hey,
Speaker 5: you're being federally investigated. We found a package that has
Speaker 5: illegal drugs and money in it and you cannot hang
Speaker 5: up from this phone call. Everything's being recorded and it
Speaker 5: will be used against union court a law. And I
Speaker 5: was like, oh shit, this is a day my life
Speaker 5: just falls apart, Like like I legitimately thought I was
Speaker 5: fucked that day?
Speaker 4: Am I allowed to say that? I hope you guys
Speaker 4: gonna end it?
Speaker 3: And one of us in this group continuously drops F bombs.
Speaker 2: I'm not going to call.
Speaker 4: That person out. Yeah we never should.
Speaker 5: Uh. But they started asking me all these questions about
Speaker 5: like where, like have you been at this address?
Speaker 4: Have you bought these things?
Speaker 5: Like that kind of stuff, like stuff that you'd feel
Speaker 5: like owly the government would know, like really owning the
Speaker 5: government would know. And like this went on for like
Speaker 5: forty minutes where they were just like asking me questions
Speaker 5: and I was validating myself on and I was with
Speaker 5: my mom. My mom and I were both freaking out,
Speaker 5: and at some point we bring on the company lawyers
Speaker 5: to like really make sure like I get my I
Speaker 5: probably should have brought them on earlier, but I was
Speaker 5: scared and.
Speaker 4: I just felt so real.
Speaker 5: And it was only until like an hour and thirty
Speaker 5: minutes in when our lawyer when we all caught them
Speaker 5: slip up on something, and it was like my lawyer
Speaker 5: started pressing them pretty hard, and at some point they
Speaker 5: got frustrated and their accent kicked in Texas accent to
Speaker 5: like some other accent that I that I was like,
Speaker 5: you are not from like America.
Speaker 4: And at that point we realized we were getting scammed.
Speaker 5: But they were only able to get to that point
Speaker 5: of trust because of all the data that had been
Speaker 5: breached in previous data breaches. My data has been in
Speaker 5: like ten data breaches or so like including equal facts,
Speaker 5: and so they just had this rich history to lean
Speaker 5: on to validate who they are as like an authority,
Speaker 5: and I trusted that for like an hour and a half.
Speaker 5: And like I have security training. I run a cybersecurity company.
Speaker 5: I can imagine my mom, my, sister, anyone else who
Speaker 5: has not had security training, like actually go the entire
Speaker 5: ten miles and give them everything, and they wake up
Speaker 5: tomorrow with like a huge amount of social security problems
Speaker 5: and like they're at bank count strained because now know everything,
Speaker 5: and like that can happen to real people all the time.
Speaker 5: And that's the real cost that we pay when we
Speaker 5: mess up and we have a data breach.
Speaker 3: That's a great point because yeah, like you mentioned, you know,
Speaker 3: from a corporate level, there's it's almost a net positive
Speaker 3: to get a data breach because the fine that you
Speaker 3: pay actually turned out to just be like really cheap
Speaker 3: marketing is the way it comes out. But like when
Speaker 3: you tie it back to and think about like your
Speaker 3: mom or your your sister or people that you know,
Speaker 3: and you can make it personal like that, that's actually
Speaker 3: like it feels like good incentive to take this seriously.
Speaker 1: So I think there's a couple of things there that
Speaker 1: are definitely worth repeating. The first one.
Speaker 2: The first one's Brian, what was your social Security number?
Speaker 6: Again to point out real quick, like the fens are
Speaker 6: going to come to your door, not call you, although
Speaker 6: that would freak me the hell out, and I don't
Speaker 6: I don't know that I would consider that on the
Speaker 6: phone if I just got a call like that, But
Speaker 6: for any anything else, you know, if this is a
Speaker 6: scam that's going on, I'm pretty sure they're just gonna come.
Speaker 6: They're gonna come get you.
Speaker 1: I know that now, right, Yeah, yeah, Like, just as
Speaker 1: soon as the worst a call is that you get,
Speaker 1: no matter what it is, just hang up first. That's
Speaker 1: that's the number one thing you've got to do. Uh,
Speaker 1: if you like, it doesn't matter what happens, You're not
Speaker 1: going to get penalized for hanging up the phone.
Speaker 7: I mean, there's no way.
Speaker 1: I And that's the whole point. They try to keep
Speaker 1: you on the line because as soon as you hang up,
Speaker 1: it's it's actually over for them. The number of times
Speaker 1: they have to call back will be a problem. So
Speaker 1: for sure, just just do that and uh, if they
Speaker 1: don't call back, then no problem.
Speaker 7: And if they do, then you know, you can continue.
Speaker 1: It from there. If you're so worried. If it's so
Speaker 1: critical for them to figure out what's going on, they
Speaker 1: for sure would call back. Yeah, so that's certainly one
Speaker 1: of them. But on the cost for companies, there is
Speaker 1: a huge aspect here that So my CEO actually did
Speaker 1: a talk couple I think last year about the ROI
Speaker 1: on security and she joked that the ROI actually stands
Speaker 1: for a return on incident because it's so beneficial to
Speaker 1: actually have this happen for you. And the thing is
Speaker 1: that it really depends on where you're at. So companies
Speaker 1: in the United States, in Russia, and China get attacked
Speaker 1: the most. It doesn't matter how big you are, how
Speaker 1: many customers you have, it doesn't matter your scale or
Speaker 1: your size. You will for sure get attacked. And without
Speaker 1: these practices in place.
Speaker 7: You will for sure get breached.
Speaker 1: The other thing that's really interesting is there's a lot
Speaker 1: of countries that just don't care about punishing you. So
Speaker 1: like the amount of fines that you get because of
Speaker 1: like say GDPR, you can actually go look it up.
Speaker 1: They're incredibly small, like sub one hundred thousand in most
Speaker 1: cases for mass of incisive. There was one recently where
Speaker 1: the company did get.
Speaker 7: Sued out of business though, So that's funny.
Speaker 1: And the other thing is that so it's good, you know,
Speaker 1: I felt great that you know, someone did something wrong
Speaker 1: and they really took the brunt of the punishment. There.
Speaker 1: The really interesting thing here is being a company in
Speaker 1: Switzerland is there's no professional there's no punishment from the
Speaker 1: government for companies from corporate level if we perform or
Speaker 1: have a security breach that's a result of executive negligence,
Speaker 1: there's up to like fine personal fines the government will
Speaker 1: charge you with and there could be other legal repercussions
Speaker 1: as well. And that's just so ridiculous. And if you
Speaker 1: work in it tar in the United States or in
Speaker 1: any NATO country, that's also personal fine. It's it's up
Speaker 1: ten million dollars and ten years in jail for having
Speaker 1: perpetrated sharing sensitive data that is regulated. So like it's
Speaker 1: not even like the company is potentially at fault there.
Speaker 1: They don't care. The company for sure doesn't care. But
Speaker 1: you as an individual, like there actually could be real
Speaker 1: repercussions for you.
Speaker 5: Yep, absolutely, Like we share this with sometimes our customers
Speaker 5: all the time of like, it's real negligence if you
Speaker 5: don't manage your secrets. You can't just like look away, right,
Speaker 5: because again, every single time sometimes up for your website
Speaker 5: or does something, they're trusting you, and that trust is
Speaker 5: basically broken if you don't actually manage the key to
Speaker 5: your digital kingdom. It's like, hey, ere, hackers, take the keys.
Speaker 5: That's what you're basically saying, if people protect them.
Speaker 2: Fair point.
Speaker 3: I think another thing, like, I think another thing that
Speaker 3: probably is an additional challenge to this is the level
Speaker 3: of effort required to get from where I'm at today
Speaker 3: in secrets management to like the ideal world that we're
Speaker 3: talking about here, because like the question number one you
Speaker 3: asked is do you know where all your secrets are
Speaker 3: some of the places I've worked in the past, Like
Speaker 3: that could be a three to six month project just
Speaker 3: to answer that question. And so how do you get
Speaker 3: executive buy in to put time and resources towards that.
Speaker 4: It's hard.
Speaker 5: I think one of the first things you can do
Speaker 5: that's pretty easy is, like there's a bunch of open
Speaker 5: source secret scanners. Truffle Hog is one. Dopper will have
Speaker 5: one at some point, I'm sure get Guardians another, and
Speaker 5: you can just like put that in the codebase and
Speaker 5: it will. You can have it set up so never
Speaker 5: admits back out, so like you know that like whatever
Speaker 5: your findings are, whatever your code is, it will not
Speaker 5: go to Truflehog or gig Guardian. But you can just
Speaker 5: get a report and just put that as a check
Speaker 5: in every repository as like a commit check. Right, So,
Speaker 5: before I can even push to get hub, I'm going
Speaker 5: to do a check to scan my code for secrets.
Speaker 5: And all of a sudden, if you can't push the
Speaker 5: production anymore because of.
Speaker 4: That check, you're probably gonna start pulling secrets.
Speaker 5: Out of product, out of out of code real quickly,
Speaker 5: and you're gonna always want to stay in this state
Speaker 5: of a green check mark. I EI there's no secrets found.
Speaker 5: And that's like one first way I think to like.
Speaker 4: Really move the needle there.
Speaker 5: That is basically free and it takes a couple of
Speaker 5: lines of code to implement.
Speaker 4: It's really really quick.
Speaker 3: Yeah, And I guess from there it's it comes down
Speaker 3: to like a campaigning issue where you start campaigning for
Speaker 3: support to get this as a prioritized project.
Speaker 4: Yeah.
Speaker 1: Yeah, I mean there's something interesting here that could be
Speaker 1: really helpful because getting it. So we talked about workload
Speaker 1: identities in there being a burden of responsibility on the
Speaker 1: API provider whoever they are, to make some changes. The
Speaker 1: one that actually helped us a lot at authris was
Speaker 1: we automatically revoke found credential so if one of our
Speaker 1: customers leaks those credentials online, we will find those automatically
Speaker 1: and revoke them immediately. And you may be like, oh, well,
Speaker 1: you could break someone's production environment, and that for sure
Speaker 1: is true and has happened. And then we get a
Speaker 1: support like, oh my god, our production environment is broken?
Speaker 1: Why did authors do this to us? And the sound
Speaker 1: truth is yeah, I know, okay, it for sure happens.
Speaker 1: But the sound truth is that credentials that are found
Speaker 1: on GitHub take less than two minutes to become utilized
Speaker 1: by a malicious attacker. Yep, that's it. Two minutes. So like,
Speaker 1: which do you want? Do you want your production to
Speaker 1: be broken or do you want all your data to
Speaker 1: be compromised? And if you look at it through the
Speaker 1: lenses of I like, well, you should be thanking us
Speaker 1: for you know, stepping in here and doing something. And
Speaker 1: the scanners are really great. They do this.
Speaker 4: Yeah, do that too.
Speaker 6: Sorry, I was just gonna say, AWS absolutely removed to
Speaker 6: credentials if you put them, say in GitHub, which I
Speaker 6: have no personal knowledge of them.
Speaker 3: Really, I just heard from red.
Speaker 6: I mean.
Speaker 1: It's almost it's almost funny though, because there were a
Speaker 1: couple of people who wanted to do some experiments with
Speaker 1: the AWS credentials, and they were struggling to do them
Speaker 1: because every time they intentionally leaked their credentials to different places,
Speaker 1: ABS kept on revoking them. And they're like, no, I
Speaker 1: want to set up a hunting pot.
Speaker 6: Doing here AWS and doing it.
Speaker 1: Intentionally, we're actually doing and yeah, so like in our emails,
Speaker 1: we actually say oh, yeah, you know, please let us
Speaker 1: know if this was like actually intentional, and then we
Speaker 1: can try to figure out how to somehow exclude this
Speaker 1: scenario because at least they know that there's like a
Speaker 1: solution path here rather than just like automatic credential revocation.
Speaker 1: And then be like, but I really want this to happen.
Speaker 1: What's going on. My credentials are invalid. Let me go
Speaker 1: create new ones and release them again to get up
Speaker 1: right like something happened there. I'd like to go through
Speaker 1: that five or six times before they learn their lesson.
Speaker 5: We've done the exact same thing with Doppler. If you
Speaker 5: if there's a Doppler token found, we will automatically broke it.
Speaker 5: I think one step we want to get you even closer, though,
Speaker 5: is being able to have some secure way of scanning
Speaker 5: your secrets that are in Doppler to see if they've
Speaker 5: been in a breach. We do something similar today with passwords.
Speaker 5: Were like, if you sign up for a Doppler account
Speaker 5: with the password that's been in a data breach, we
Speaker 5: actually you and we say you have to use a
Speaker 5: different password, and if you log in again and that
Speaker 5: in that time since creating your account, your password has
Speaker 5: been a data breach, we will force.
Speaker 4: You to change the password.
Speaker 2: That's pretty cool.
Speaker 4: Yeah, I forced.
Speaker 6: People to change it because Google tells me that about
Speaker 6: my passwords all the time, and I'm like, oh, but
Speaker 6: I'm supposed to be secure. Instead of just rotating, you know,
Speaker 6: like various things that I rotate through for passwords, they
Speaker 6: don't make me change it, which is which is a
Speaker 6: downfall for me.
Speaker 3: Password one, password two, password three, Now I've got to
Speaker 3: remember password four as well.
Speaker 6: I know, right, what am I going to do?
Speaker 4: Use a password manager?
Speaker 5: You want like a fifty character a long password that
Speaker 5: you could not possibly remember that's what you want.
Speaker 1: So you got to be careful there, because I actually
Speaker 1: had to start keeping a list of all of the
Speaker 1: websites that told me that I could put a sixty
Speaker 1: three character password. But then when you sign up, but
Speaker 1: then when you go to enter it, it said it
Speaker 1: doesn't match because it's secretly truncating some part of it. Yes,
Speaker 1: So like it really starts to get annoying when you
Speaker 1: think that they support something to the level of security
Speaker 1: standard that you want and then secretly, under the hood
Speaker 1: they do something different. And I have a I have
Speaker 1: a list of those companies that I've paid very.
Speaker 4: Maybe that have you published it?
Speaker 1: No, that's still private for the moment, and don't jesus,
Speaker 1: I got some I got some good stories here. So
Speaker 1: one of them would truncate your password down to twenty characters,
Speaker 1: but for the two factor off. What it would do
Speaker 1: is it would ask you for your TOTP.
Speaker 7: Six character code and.
Speaker 1: Or pen that to the end to make a twenty
Speaker 1: six character password and send that in the password field.
Speaker 1: So if your password was anywhere above twenty six characters,
Speaker 1: you would just get a wrong answer. But if it
Speaker 1: was somewhere between twenty one and twenty six, it would
Speaker 1: cut out part of the TOTP code.
Speaker 7: And like it wouldn't work, and then you just wouldn't be.
Speaker 1: Able to get in at all. And also what that
Speaker 1: does is it tricks your password manager into thinking the
Speaker 1: TOTP code is part of your password. And every single
Speaker 1: time I go to the site, it asked me if
Speaker 1: it want if I should remember that new password update.
Speaker 1: Please don't do that. Like, if you're designing a system,
Speaker 1: please stop using passwords altogether, honestly, Like we have this
Speaker 1: off by default for all of our customers.
Speaker 7: They can't create a password.
Speaker 1: Database unless they come and contact us and justify, like
Speaker 1: who their audience is, why they need this, and what
Speaker 1: sort of rules are going to put in place, because
Speaker 1: it's just so ridiculous in the corporate space, like con
Speaker 1: federated logins, oidc samill sso all of those are so
Speaker 1: much better. Please just use one of those and don't
Speaker 1: use passwords password Like eighty six percent of all vulnerabilities
Speaker 1: are a result of password usage, like simcard swapping, you know,
Speaker 1: found in breaches, et cetera, et cetera. Like just please,
Speaker 1: like passwords are gone, like they're done, they're over.
Speaker 4: I think everyone on this can agree with that.
Speaker 6: I don't know you're still using passwords.
Speaker 3: Or and I don't know that you're like, are you
Speaker 3: are you serious about that?
Speaker 4: No, I agree with warn here. I think passwords should
Speaker 4: be done. Their time is come. I'm just agreeing with them.
Speaker 1: So, uh, my CEO actually has another talk at q
Speaker 1: COON in November in San Francisco that everyone should go
Speaker 1: to if you're in the area, and she'll actually be
Speaker 1: talking about the fact you do need to have like
Speaker 1: somewhere between three and five actual passwords in your life. Unfortunately,
Speaker 1: like there's no way around that, and you probably should
Speaker 1: have ones that the Rendall Monroe correct horse battery staple
Speaker 1: or is it horse battery staple correct. I can never
Speaker 1: remember the order of the forewords, that's the problem. But uh,
Speaker 1: you don't want to just use a set of path
Speaker 1: like words as your password, because now all of the
Speaker 1: brute force attacks know that up three to five words
Speaker 1: could be your password as well. So you got to
Speaker 1: you got to make some changes in there. And uh,
Speaker 1: Apple actually has a pretty good strategy for dynamically generating passwords,
Speaker 1: where they make a bunch of fake words that are
Speaker 1: consonant vowel sounds that are strung together so you can
Speaker 1: sort of remember it and use that instead.
Speaker 7: So that's pretty clever.
Speaker 1: But I highly recommend like all those things with symbols
Speaker 1: and whatnot. It's it's just it's it's it's over, honestly,
Speaker 1: So three to five. If you have more than five passwords,
Speaker 1: you're probably doing something unsafe.
Speaker 6: What about my pets names?
Speaker 2: Oh, those are totally in scope.
Speaker 1: Yeah, fantastic.
Speaker 7: I mean for some like now, you've got to tell
Speaker 7: them those Callilli.
Speaker 4: Which pets?
Speaker 6: For those Jillian, it could be Eddie pet, it could
Speaker 6: be pets from like here to childhood. I think, isn't
Speaker 6: that a common security question?
Speaker 2: Like yeah, what's your first dog's name.
Speaker 6: Your first pet, first car, like all that kind of stuff.
Speaker 6: So I don't know if it's good enough for the
Speaker 6: security question, it should be good enough for my passport.
Speaker 7: It's pretty goodly you brought that up.
Speaker 1: I'm sure Brian has some opinions on this too, likes
Speaker 1: just reidelines of the eight hundred.
Speaker 6: I do just come on the show and start trouble
Speaker 6: like I have.
Speaker 1: Now it officially says now it actually if as like
Speaker 1: you like you shall not force password rotation, like we know,
Speaker 1: like that's wrong. For sure. Secrets are a little bit
Speaker 1: in the gray area of whether or not force rotation.
Speaker 1: Uh is required outside of expected data breaches, but uh yeah,
Speaker 1: for sure, like if you were forcing password rotation. Now
Speaker 1: there's a government that is more ahead of where you're
Speaker 1: at as far as good password hygiene.
Speaker 5: Another thing that I'd strongly recommend is whenever they're asking
Speaker 5: for there's like recovery questions of like what, uh, what's
Speaker 5: your mother's maiden name or what's the name of your
Speaker 5: first pet, don't actually put that go and generate a
Speaker 5: new password and put that in like like in like
Speaker 5: one pastord begin of multiple fields outside of the used
Speaker 5: name password, create another field call that the name of
Speaker 5: the question, and then have a type password there and
Speaker 5: put in like a sixty character password in there.
Speaker 2: So create a fake family.
Speaker 4: Yeah, really long family.
Speaker 7: I do have a warning there.
Speaker 1: So a long time ago I thought this was a
Speaker 1: great idea, and I generated this site to actually dynamically
Speaker 1: generate shot two PTY six encoded answers based off of
Speaker 1: the questions. So I don't even need to remember the question.
Speaker 1: I just copy and paste the question into this generator
Speaker 1: and it will generate a shot hash for me to
Speaker 1: put there.
Speaker 7: However, it broke me because I was talking with some.
Speaker 1: Customer service experts who would often be on these calls
Speaker 1: that have to verify security questions, and they for sure
Speaker 1: were like, yeah, we do get people with the list
Speaker 1: and when they ask you to verify your question, some
Speaker 1: people for sure just say, oh, yeah, it's just some
Speaker 1: random characters, like I don't remember, like that's what I
Speaker 1: put there. I put random, like it's not a word.
Speaker 1: I put random characters there. And that gets by having
Speaker 1: put like a password in the security question. So security
Speaker 1: questions are over too. But I definitely recommend a real word.
Speaker 1: Definitely a real word, but not the right answer, as
Speaker 1: Brian said, and to get over this and just store
Speaker 1: that in your password manager as well.
Speaker 5: Maybe should be one of those passwords that are like
Speaker 5: a chain of words together that you can easily remember, like.
Speaker 4: I would to the park or something like that.
Speaker 1: I got a list of those that don't accept that,
Speaker 1: because some of them thought they would be really smart
Speaker 1: and there would be a drop down menu of the
Speaker 1: answers that you could pick, because you know, that's what
Speaker 1: they wanted to go with and I'm like, first of all,
Speaker 1: my right answer isn't even here, Like it's like what
Speaker 1: was your what it was your first instrument you played?
Speaker 1: And I'm like, I couldn't even put the right answer
Speaker 1: because it's not listed there.
Speaker 7: So like I don't know what game you're playing.
Speaker 4: Yeah, I'm really curious what like ten years from now,
Speaker 4: what this whole identity space is going to look like,
Speaker 4: because it's changing.
Speaker 1: Yeah, the rest that I would talk about that because
Speaker 1: that's pretty much what I spent all my.
Speaker 7: Day thinking about.
Speaker 1: And I'll say that there is this aspect of past
Speaker 1: keys via hardware tokens isn't the future because it's still
Speaker 1: too much churn in difficulty and complexity for most people
Speaker 1: to get right. And something where the past keys can
Speaker 1: be shared between multiple devices is probably correct, but not
Speaker 1: the Google or Apple approach, but something way more secure,
Speaker 1: and it's coming. There's actually an open standard that allows
Speaker 1: for past key transmission between different devices in a secure way,
Speaker 1: and I think that will be the first step that
Speaker 1: really helps us there. The next one is the root
Speaker 1: of trust, like our browsers working for us and making
Speaker 1: sure that the security cokens the JWT's the session keys
Speaker 1: that we have are device bound and can't be exfiltrated
Speaker 1: to an attacker and then reused to generate new stuff
Speaker 1: and will always be stuck in cross site scripting land.
Speaker 1: But those actual tokens will now be worth outside of
Speaker 1: the original device because you'll need the device private key
Speaker 1: in order to sign each request. And we're working on it.
Speaker 1: It's happening, the right working groups are focused on it,
Speaker 1: but you know, it's still a thing that and users
Speaker 1: are not going to see a huge impact and say
Speaker 1: the next ten.
Speaker 5: Years, yeah, and then once it does happen, you're gonna
Speaker 5: have to like roll it out, which will also be
Speaker 5: another wave of adoption as well, a slow one.
Speaker 1: It's hard to convince those companies that don't have a
Speaker 1: financial stake and doing the right thing to make a
Speaker 1: change fundamentally, And so like, I'm really looking forward to
Speaker 1: whatever impact Doppler can make on the industry to actually
Speaker 1: convince people to move to workload identity verification for every
Speaker 1: request and not just because your customer happened to be
Speaker 1: someone that had was in Germany and had some ridiculous
Speaker 1: security requirements there or required twenty seven KO one or
Speaker 1: something or Beta ramp high in order to.
Speaker 2: Get those customers on board.
Speaker 5: We have some active projects around looking into improving the
Speaker 5: compliance body so that they are more compassing of like
Speaker 5: secure secrets management, and I I think when we make
Speaker 5: some serious progress there, our goal is to like make
Speaker 5: that more because once you get into SoC two, it's
Speaker 5: a beautiful thing like SoC too.
Speaker 4: In a way, it's like if one company saw to,
Speaker 4: every company sock to. That's kind of how it has
Speaker 4: to work because.
Speaker 5: You have a requirement that all your all your vendors
Speaker 5: that use are sought to. So that kind of just
Speaker 5: has like this ripple effect where if all the BDOC
Speaker 5: companies are sockd to, then every B two B company
Speaker 5: sock too. And if we can get in in SoC two,
Speaker 5: I think that's a pretty effective way to roll to
Speaker 5: roll out what we're looking for. That's the dream at least,
Speaker 5: but it's gonna take a long time and a lot
Speaker 5: of work to make that happen.
Speaker 7: I I love your optimism.
Speaker 1: I'm just gonna repeat that, like, I just think I
Speaker 1: love the existation you have there. It's it's just so
Speaker 1: great to hear someone who who thinks that we can,
Speaker 1: you know, get down that path and and get to
Speaker 1: success that way. It's it's it's awesome.
Speaker 4: Maybe it's not purely optimism.
Speaker 5: I like, at some point, I'm just like this world
Speaker 5: is a capitalist structure, and like, at some point, with
Speaker 5: enough capital and enough resources, anything should be possible. And
Speaker 5: I'm not saying you like bribe, So I'm saying more like,
Speaker 5: you just put enough lawyers in the room and you
Speaker 5: try to navigate this like it's a political machine, and
Speaker 5: eventually you'll get there. And then the question is can
Speaker 5: we just raise enough money where we have the force
Speaker 5: projection to do that?
Speaker 1: So SoC two for anyone that doesn't have it, ends
Speaker 1: up being a write out some policies and prove that
Speaker 1: you're following them where compared to actually putting valid security
Speaker 1: strategies in place. So it's always going to be a
Speaker 1: race to the bottom here, and I think we're going
Speaker 1: to see SoC two getting cheaper and less valued over
Speaker 1: time as people more people realize that it is a
Speaker 1: compliance checkbox. It's checkbox bake security or insurance, it really is,
Speaker 1: rather than actually providing a real value. And that's a
Speaker 1: sort of a sad fact there, and there's really no alternative,
Speaker 1: like maybe that's what we need maybe we need some
Speaker 1: sort of non regulatory body that can verify companies are
Speaker 1: compliant in performing actual security. And that's sort of hard
Speaker 1: because that's driven from like the mindset of the founders
Speaker 1: and the executive team and the leadership and money Trump's
Speaker 1: security every time.
Speaker 6: See.
Speaker 5: I think sock two is actually pretty great from a
Speaker 5: standpoint of like if you're a saw to all your
Speaker 5: vendors have to because that just creates this beautiful fact
Speaker 5: where the entire industry has some baseline of security. I
Speaker 5: think there's just like one critical flaw of sock two,
Speaker 5: and that's it's like tax people are like auditors. The
Speaker 5: auditors are like literal accountants. Those are the people that
Speaker 5: are setting the policies. I just don't understand how accountants
Speaker 5: are setting policies around security. It's like completely different fields, right,
Speaker 5: Like it'd be like someone who does your taxes is
Speaker 5: like the one who's saying you should be secure. I'm like,
Speaker 5: maybe leave it to the security professionals who think about
Speaker 5: this all day long. If that change, one change happened,
Speaker 5: I would bet like the world would.
Speaker 4: Be a lot safer of a place.
Speaker 1: I mean, I'm with you. It evolved from sok one
Speaker 1: being a CPA auditor of verification that they would take
Speaker 1: actual liability if your finances weren't in check, and then
Speaker 1: evolved to actually evaluating different parts of your business reliability,
Speaker 1: disaster recovery, business continuity in case of the problem, and
Speaker 1: of course that falls into well how do your I
Speaker 1: systems actually work as well? So there's a lot there,
Speaker 1: but I'm with you. I so to put in perspective
Speaker 1: of we use not vitamins but pain pills or painkillers.
Speaker 1: The as the analogy, I think governments would have to
Speaker 1: pay companies who were secure, Like if you are secure
Speaker 1: and you get a certification, I think that if you
Speaker 1: got paid, that would be a really driving good driving
Speaker 1: factor there.
Speaker 5: It would have to be enough to really move the needle,
Speaker 5: because I could even imagine some companies are like, yeah,
Speaker 5: even a million year probably.
Speaker 4: Wouldn't move the needle from it.
Speaker 5: I don't know, like maybe it's a percentage. I really
Speaker 5: do feel like we don't need to pay them though,
Speaker 5: Like I think so two is like the the requirement
Speaker 5: that all your vendors are shocked to your requirement I
Speaker 5: think is so powerful already that pretty much the entire
Speaker 5: industry has adopted it, we just need different people at
Speaker 5: the helm.
Speaker 4: Like and I know where it started.
Speaker 5: I completely align you there, but I kind of see
Speaker 5: it like Kubernetes, a little bit like that started within
Speaker 5: Google and it got so big it got pulled out
Speaker 5: of Google into its own body that then could manage
Speaker 5: it from then on. And I'm saying, like, sock choose
Speaker 5: the same thing. They created something amazing with SoC two,
Speaker 5: Let's pull it out of the of the accountants and
Speaker 5: let's have real security people run this thing. And like
Speaker 5: let's give it a V two or maybe a V three.
Speaker 5: I think that would do a lot of good.
Speaker 2: I love.
Speaker 1: Well, it's like, oh, there's so much going on here.
Speaker 6: So I heard a lot with security and very much
Speaker 6: like that's somebody else's job. But you guys have like
Speaker 6: the nice provided for that kind of thing, which I
Speaker 6: guess so I am the problem I suppose in this conversation,
Speaker 6: like in general.
Speaker 7: Well maybe that's a good twist though, Like do.
Speaker 1: You feel, like Jillian, you have some comp here to
Speaker 1: cause your company to do something different or you have
Speaker 1: flexibility to pull in libraries or other providers to help
Speaker 1: you support better security.
Speaker 6: Oh yeah, definitely, Like for the most party, they tend
Speaker 6: to rely on the you know, like the providers and
Speaker 6: things that they work with, because I work with primarily
Speaker 6: data science companies, so they're not like technology companies where
Speaker 6: they care about the technology in and of itself. So
Speaker 6: pretty much as little computing as they can do, they
Speaker 6: will do. Like these guys like if they could analyze
Speaker 6: the data from their laptop, that's what they would be doing.
Speaker 6: So it has to be, you know, like Brian was saying,
Speaker 6: it has to be a really easy sell. It has
Speaker 6: to you know, it has to be the candy and
Speaker 6: not the vegetables. It has to be for the most part,
Speaker 6: something they don't even notice happening. It just kind of
Speaker 6: like gets bundled into the background. So pretty much anything
Speaker 6: on you know, that kind of front, it's it's not
Speaker 6: even so much a question for me. I don't ask
Speaker 6: them Like I wouldn't ask my clients like, oh do
Speaker 6: you want this? I would I would just go do this, right,
Speaker 6: I wouldn't say like, oh, do you want for me
Speaker 6: to keep your credentials off of GitHub? I would just
Speaker 6: keep their credentials off of GitHub in that scenario. So
Speaker 6: I do yeah, I do think. So I do think
Speaker 6: like smaller you know it providers or consultants, are you know,
Speaker 6: like just engineers in general, especially if you're working for
Speaker 6: a company where technology is not their focus, you do
Speaker 6: have a lot of say in the technology stacks that
Speaker 6: are used. So we just got to sell this to
Speaker 6: all the developers, right is that? Is that what we're
Speaker 6: going for?
Speaker 4: And then eventually we work away at the compliance bodies
Speaker 4: and those committees.
Speaker 1: I do have a question about Doppler maybe, and that's like,
Speaker 1: what is the minimum implementation you can have here?
Speaker 2: Is there?
Speaker 1: Is it just maybe replacing out the cloud SDKs with
Speaker 1: Doppler SDKs for interacting with Supermanager. Is there something else
Speaker 1: that has to be done in order to sort of
Speaker 1: start getting the benefit right away? Or is there like
Speaker 1: a large upfront integration that has to be done to
Speaker 1: make it effective?
Speaker 4: Yeah?
Speaker 5: Great, question usually depends on the complexity but the company
Speaker 5: that we're working with from their infrastructure standpoint. But I'd
Speaker 5: say for like a small startup of like series being below,
Speaker 5: they usually get up and operational in like a couple hours.
Speaker 5: So like you're usually using some cloud provider like ABSG
Speaker 5: Spears your secrets manager, we would directly set up a
Speaker 5: sink or an integration and write directly into that, so
Speaker 5: you don't need to change your sd case at all.
Speaker 5: It's literally just put like a layer on top, which
Speaker 5: is Doppler, and then they would download our CLI and
Speaker 5: use that for local development. For much larger companies, it
Speaker 5: can take in the order of weeks. We've had very
Speaker 5: few go longer than a week's even like extremely large entities,
Speaker 5: like we have a one customer that's like on a
Speaker 5: three year roll out to one hundred and twenty five
Speaker 5: thousand engineers, and even them, it was like a couple
Speaker 5: of weeks to get them like integrated in their infrastructure.
Speaker 5: And usually it's like just connecting dots. It's okay, you're
Speaker 5: using a toa secrets manager, you're using GitHub workflows.
Speaker 4: Here, we're just gonna connect all.
Speaker 5: The dots into Doppler and then from there we're going
Speaker 5: to add local development through like the vis code extension
Speaker 5: we have plus the Doppler CLI, and so it's a
Speaker 5: pretty formulaic approach that that's very quick, I would say.
Speaker 5: And when you set up those integrations, we'll do bulk
Speaker 5: imports as well, so we try to streamline a lot
Speaker 5: of it. I'd say, where things get a little bit
Speaker 5: more complex, as if we have customers that like to
Speaker 5: do everything the terraform way, then we help them kind
Speaker 5: of like set up all that stuff instead of in
Speaker 5: the UI, but through terraform, So you can actually manage
Speaker 5: pretty much every part of Doppler and including all the
Speaker 5: orchestration and workflows that.
Speaker 4: We have in Doppler through Terraform.
Speaker 5: And I would say that would slow them, slow them
Speaker 5: down a little bit and initially, but then speed them
Speaker 5: up on the long haul when they have are like
Speaker 5: bringing on like tens of thousands of projects.
Speaker 1: I like that that you really gave credence to that
Speaker 1: that using IIC there does does actually slow you down
Speaker 1: for development I do thing. It's a lot of truth
Speaker 1: there that people don't like to listen to.
Speaker 4: Yeah, it's just like a high upfront cost, but then
Speaker 4: it pays difference.
Speaker 1: There's something here where like the IC cloud for the
Speaker 1: cloud providers and whatnot. Don't always optimize for easy interactions
Speaker 1: right that it's it's to have it be fixed and
Speaker 1: maybe work and make it easy to make changes, but
Speaker 1: not really quick and easy. Whereas your your console, your UI,
Speaker 1: r CLI or optimize for ease of use and getting
Speaker 1: to the value as quick as possible.
Speaker 5: Yeah, I would say that I see it's like I
Speaker 5: almost see it as like stability insurance, right, like like
Speaker 5: you're it's there to keep you stable and reliable and
Speaker 5: very predictable, but it's not there for speed.
Speaker 4: Though you can once you have it, once you have.
Speaker 5: Achieved stability, it's very easy to boot up new infrastructure
Speaker 5: with it, which can give you some speed benefits. But
Speaker 5: sure that's usually come at the cost of a lot
Speaker 5: of upfront investment, so it's like paying you're paying down
Speaker 5: that or drawing down all all that initial investment over time.
Speaker 1: So I know we opened a huge topic by saying
Speaker 1: we're going to talk about secrets management, and I think
Speaker 1: we definitely dove into all the different tangents that that
Speaker 1: were related to it. Was there anything on this that
Speaker 1: you feel like we missed that would have you think
Speaker 1: a huge impact for the audience something maybe some special
Speaker 1: wisdom there, anything worth sharing.
Speaker 5: Yeah, I would say that the only thing that we
Speaker 5: didn't touch on is it's better to start early. I know,
Speaker 5: when you're first starting out, you're building a company, you're
Speaker 5: all about like I need to get to product market
Speaker 5: fits and then at some point you'll need to think
Speaker 5: about like, how do I protect the company now that
Speaker 5: I've achieved product market fit?
Speaker 4: And what we found is that it's adding security later
Speaker 4: on if it's not part of the DNA of the company.
Speaker 4: Just almost never works.
Speaker 5: Like you'll you'll take all you'll feel like you're taking
Speaker 5: all the right actions, but it won't actually give you
Speaker 5: the security benefit you're looking for, and thus you'll be vulnerable.
Speaker 5: And so my strongest suggestion would be to use a
Speaker 5: secret manager, Doppler or something else day. One does not
Speaker 5: have to be the best solution, but just use something,
Speaker 5: get used to it, build it as part of the
Speaker 5: DNA of your company and of your engineering philosophy, and
Speaker 5: then grow with it over time.
Speaker 4: And at least there you're.
Speaker 5: Coming from a stable foundation versus one that's cracky as
Speaker 5: how that you're trying to lay layer a building on
Speaker 5: top of.
Speaker 4: Because I think it'll save.
Speaker 5: You a lot of headaches and time down the line,
Speaker 5: and also I think the right secrets manager, for what
Speaker 5: it is worth, will make you feel more productive. So
Speaker 5: just calling that out there, that's all I got.
Speaker 2: Seems fair enough. On that note, should we do some picks, Yeah,
Speaker 2: let's do it all right?
Speaker 3: Cool, Jillian, I'm throwing you under the bus because you've
Speaker 3: been gone for a while. What did you bring for
Speaker 3: a pick today? I mean, it's got to be something
Speaker 3: cool since you've had plenty of time to figure something out.
Speaker 6: I mean, that's a lot of pressure for what I
Speaker 6: was gonna pick. I was just I was gonna like,
Speaker 6: I'm looking up my window, it's spooky season, it's autumn.
Speaker 6: It's one of the few live action videos before like
Speaker 6: cell phones, that my kids will actually watch. And so
Speaker 6: that was that was it. Hocus Pocus. Maybe I'll throw
Speaker 6: Halloween in there too.
Speaker 3: Just in general, Halloween the movie or the holiday.
Speaker 6: No, the holiday. I don't like any weird horror scary movies. Okay,
Speaker 6: Like hocus Pocus is as scary as it gets for me.
Speaker 1: I don't know why you're laughing, will like that.
Speaker 7: That Hocus movie for sure traumatized.
Speaker 1: Me as a child, like that was not I didn't
Speaker 1: I didn't appreciate that experience. That was very troubling, especially
Speaker 1: where the cat. You know, there's an animal death in
Speaker 1: the end, and that's that's always struggling for me.
Speaker 6: Oh, that's true. I was I was okay with hocus Pocus.
Speaker 6: The never Ending Story for some reason is like the
Speaker 6: kids movie that really freaked me out, so we can
Speaker 6: like bond over our shared trauma of nineties movies. Like
Speaker 6: Another Day.
Speaker 1: I actually liked ever I did a story, you know,
Speaker 1: a different world, was, you know, sufficiently interesting.
Speaker 4: I liked back in the day, Halloween Town if you've
Speaker 4: ever heard of it. It was like a Disney series,
Speaker 4: a couple of movies. But I would say it's great
Speaker 4: for kids. That's magic in it, a little scary, but
Speaker 4: not too scary.
Speaker 6: I love all the kids Halloween movies and stuff like that.
Speaker 6: They're so much fun.
Speaker 2: They are, all right, Warren, how about you? What'd you
Speaker 2: bring for a pick?
Speaker 1: You know, I thought for sure you were you were
Speaker 1: gonna tell me to go first again, which I you know,
Speaker 1: I've just gotten so used to.
Speaker 7: I'm happy to just do it from here on out.
Speaker 2: You're gonna follow your sword for us?
Speaker 1: Yeah, I'll just I'll just admit that. So what I
Speaker 1: was when you asked me how I was doing, I
Speaker 1: had the whole, the whole episode to actually think about that,
Speaker 1: and what I came to is, so I guess I
Speaker 1: sort of have two picks today. The first one is
Speaker 1: I'm today is like one of the first days of
Speaker 1: my short little intermittent fasting that I do every quarter
Speaker 1: where I just like don't eat any food for three
Speaker 1: to seven days and it just makes me feel so
Speaker 1: much better. There's a bunch of health benefits associated with
Speaker 1: taking a break from eating, and I feel better usually
Speaker 1: by the time I'm done, so like sort of like
Speaker 1: a full cleanse in a way, I highly recommend there's
Speaker 1: no negative health impact at all from doing this. I mean,
Speaker 1: it's sort of psychological. It's nice to think like, oh,
Speaker 1: I don't have to eat like all the time. So
Speaker 1: I really appreciate that so great since I started doing it.
Speaker 1: And I think my real pick for today is going
Speaker 1: to be a book, because I always pick a book
Speaker 1: I guess called Drive by Daniel H. Pink that talks
Speaker 1: about the truth of what motivates us and how we
Speaker 1: as humans get motivated and what actually we use to
Speaker 1: drive our desire, what we work on, what we find
Speaker 1: enjoyment in. And the one really important learning that I
Speaker 1: pulled out from the book is that you will always
Speaker 1: lose happiness in something where you expect a reward for it.
Speaker 1: So if you really like doing something, and then you
Speaker 1: make that your job, and your job pays you to
Speaker 1: do that thing, you will actually lose motivation to perform
Speaker 1: that action. Which is sort of a sad story, but
Speaker 1: I think there's a lot of truth in it. When
Speaker 1: you start associating money with the thing that you're doing.
Speaker 3: Yeah, I've seen that happen in my own life, and
Speaker 3: it's surprising.
Speaker 2: You're like, oh, damn, I used to enjoy this.
Speaker 3: What happened in retrospect, You're like, oh, I turned it
Speaker 3: into a job.
Speaker 2: That's my bad.
Speaker 6: You should not monetize your hobbies, right, throw that out.
Speaker 6: There's life advice. Just don't just sit down and crochet
Speaker 6: your scarps or whatever. It doesn't have to make the money.
Speaker 1: Now, I feel like there's a story there that I'm
Speaker 1: gonna want to have to hear at some point.
Speaker 3: You're gonna have to do like a non DevOps episode
Speaker 3: at one point just to cover some of these topics
Speaker 3: we keep bringing up. I think, so, Brian, what about
Speaker 3: you would you bring for a pick?
Speaker 5: I got too. The first one is perplexity. It's kind
Speaker 5: of like the new version of Google, and like imagine
Speaker 5: you're trying to like answer a question like how do
Speaker 5: I cook steak with an air fryer? And like instead
Speaker 5: of googling that where you can get a bunch of
Speaker 5: links you have to go through, it kind of just
Speaker 5: gives you the answer. So it's like chatbut but with
Speaker 5: like search capabilities and advanced reasoning built in. There pretty
Speaker 5: much hasn't been a question that I've thrown a where
Speaker 5: it failed at Like it's it's really good, including like
Speaker 5: what happened yesterday in the news, like really really recent stuff.
Speaker 5: It does a great job of analyzing and you can
Speaker 5: ask you like very complex chain of thought questions where
Speaker 5: like like I find a lot of times I'm searching
Speaker 5: for something and then I'll have a follow up question
Speaker 5: and so now I need to like ask another query
Speaker 5: into Google. And this is like you just it's like
Speaker 5: almost like a thread of questions so you can get
Speaker 5: like every follow up question has all the context of
Speaker 5: the first question or the previous questions.
Speaker 4: So I really love perplexity. I've completely shifted.
Speaker 5: Over to using perplexity for almost any knowledge based question
Speaker 5: of like how do I do ex er? What do
Speaker 5: I think about this? Or what happened in the stock market?
Speaker 5: Why did this price go up?
Speaker 4: Whatever? It is.
Speaker 5: The second one is pickaball. I love pickaball, love it
Speaker 5: so much. I try to play like five days a week,
Speaker 5: two to three hours a day. It's hyper addicting. I
Speaker 5: burned like thousand to thousand, eight hundred calories a session.
Speaker 5: It's like a really high mount of calories. And it
Speaker 5: doesn't feel like a workout at all. Like it's probably
Speaker 5: the first workout sport that I've played that I genuinely
Speaker 5: love doing and I don't and I'm not just like
Speaker 5: waiting for it to end. So if there's any people
Speaker 5: like that out there who have, like will always wanted
Speaker 5: to get into sports or always wanted to get in
Speaker 5: the gym, but always felt like I never really connected
Speaker 5: with them, try pick a ball. There's something magical about it.
Speaker 5: Almost everyone I show two falls.
Speaker 6: In love with it.
Speaker 3: Yeah, I've never played, but I know people who do,
Speaker 3: and it like the level of passion amongst the pickleball
Speaker 3: community is pretty wild.
Speaker 4: Isn't like?
Speaker 5: And it's very uh, it transfers well, like you you
Speaker 5: you catch that bug where you're like, I just got
Speaker 5: to be playing today.
Speaker 4: I did not play at all, and I feel guilty.
Speaker 4: I don't know.
Speaker 5: It's it's I The last time I felt this level
Speaker 5: of passionate and drive for something was like building a company.
Speaker 5: So let's use like a pretty high bar for me.
Speaker 5: It's like, uh so strongly recommend.
Speaker 3: Right on excellent, So I'm gonna pick because we were
Speaker 3: talking about this before we started recording the episode. The
Speaker 3: book by William fortun one second after. It's a science
Speaker 3: fiction novel that talks.
Speaker 2: About the struggles of.
Speaker 3: A community after an emp or electromagnetic pulse bomb was
Speaker 3: detonated over the United States and so that wipes out
Speaker 3: all of our modern infrastructure, and it's I just found
Speaker 3: it to be a fascinating book because of the things
Speaker 3: that happened. It's you know, you don't normally think about,
Speaker 3: and it was a it was well written and very
Speaker 3: engaging throughout. So if you're into that kind of stuff,
Speaker 3: definitely a cool book to read. And I think that
Speaker 3: brings us to the end of the episode. Brian, thank
Speaker 3: you so much. It's been great having you on a show.
Speaker 3: Very insightful and yeah, crap, now I got work to do, thanks.
Speaker 4: Man, right.
Speaker 6: Having this episode with a checklist?
Speaker 2: Yeah, no kidding for real.
Speaker 3: Jillian, it's nice to have you back on the show Warren,
Speaker 3: as always, thank you for being here and Brian hope
Speaker 3: to hear from you again.
Speaker 2: Best of luck with Doppler and keep in touch. We'll do.
Speaker 3: Thank you all right, you bet, And to all our listeners,
Speaker 3: thank you for listening and we'll see you all next
Speaker 3: week