Latest / Identity at the Center / #222 - Identity Standards with Justin Richer of Bespoke Engineering

Transcript

#222 - Identity Standards with Justin Richer of Bespoke Engineering · Identity at the Center

• 0:05
  This is identity at the center. If it has anything to do with I
• 0:11
  am, This is the go to podcast now your hosts Jim McDonald and
• 0:17
  Jeff Steadman. Welcome to the Identity of the
• 0:22
  Center podcast. I'm Jeff and that's Jim.
• 0:24
  Hey, Jim. Hey, Jeff, how are you?
• 0:26
  Oh, not so bad. Yourself doing great.
• 0:29
  I wanted to bring up the call that we had the other day, Megan
• 0:34
  and Adrian from over at the Authenticate Conference of Fido
• 0:37
  Alliance and that we're going to be on the Mainstage on the first
• 0:42
  day. Scary.
• 0:43
  And what it Well, it is a little scary, believe me, it's a little
• 0:46
  scary. But what I thought was really
• 0:49
  cool about or what I thought was like hilarious, I thought they
• 0:51
  were pulling our leg because I said.
• 0:55
  You know, how long, how long of a session are we looking at?
• 0:57
  And they're like, oh, like an hour and a half.
• 0:59
  And I thought, oh, that's funny. That's really funny.
• 1:02
  But it was serious. So who knows how long it'll be?
• 1:06
  Yeah. Because, you know, the more I
• 1:07
  give it thought after after the fact, I was like, you know, we
• 1:09
  could we have a lot of fun with an hour and a half.
• 1:12
  What do you think? We definitely could.
• 1:14
  I I don't think we've actually done an hour and a half on this
• 1:16
  podcast. I think the closest we've got
• 1:17
  maybe is like an hour 10 hour 15 even that we feels are really
• 1:21
  long like most people I think. Prefer us to be around 45 or 50
• 1:24
  minutes, but sometimes we just go on and on.
• 1:27
  We just can't get enough of our own voices, apparently.
• 1:30
  We try to make it sound natural too, but we could have a lot of
• 1:33
  fun. I think we'll probably settle
• 1:34
  probably on just under an hour or something.
• 1:36
  That probably makes the most sense, but.
• 1:39
  Yeah, it'll be interesting. We'll be up on the main stage
• 1:40
  and I think we're, I think technically we're a keynote, you
• 1:43
  know we're looking at doing like a live.
• 1:45
  We haven't figured it out. So this is obviously all subject
• 1:47
  to change, but I think the idea is to do almost like a live.
• 1:51
  Podcast episode in front of people, Try to get some guests
• 1:54
  to come on, maybe talk about different issues and things that
• 1:57
  are going to be referenced throughout the conference.
• 2:00
  But yeah, it's very cool. Yeah, the Authenticate
• 2:03
  conference is coming up. We'll be there.
• 2:05
  We've got discount code ID AC15, podcast ID AC15, podcast.
• 2:11
  Get you 15% off of your registration.
• 2:14
  So definitely use that. That's a good way to show
• 2:16
  support. You know, for the for the
• 2:17
  podcast itself, it's October 16th to the 18th.
• 2:21
  It's in Carlsbad, CA, so nice on the beach, a little bit north of
• 2:26
  San Diego. I think it's on a golf course.
• 2:29
  So yeah, kind of a nice deal situation.
• 2:33
  I've got to say, I'm not, I'm not proud of this, but I do kind
• 2:37
  of judge conferences based on where they're located. 100% that
• 2:41
  and their cookies. Yeah.
• 2:43
  So I looked at, I was doing it a meeting we had today and there
• 2:48
  was. You were on it.
• 2:49
  Few other friends were on it and we jumped on Google Maps and I
• 2:54
  brought up there's a four drop conference way back in the day
• 2:57
  at the Asilomar Conference Center.
• 3:00
  I was like that was probably one of the coolest conferences.
• 3:02
  I was at this one also and they also had another one at Half
• 3:06
  Moon Bay. This one, this location looks
• 3:08
  just as good man. I mean it is like Primo
• 3:12
  location. So if you're on the on the
• 3:15
  fence. I'd say the location should put
• 3:17
  you on the other side of the fence.
• 3:19
  Yeah, for sure. I mean ideal location, good time
• 3:22
  of year, October, I mean it's great.
• 3:24
  It would be great weather. It's California, so it's always
• 3:25
  pretty good, but that's a good time of year.
• 3:27
  But yeah, so that's our, that's our plug.
• 3:31
  Come visit us, come visit the Authenticate Conference, come
• 3:33
  support Vito, come support us. We'll have links in our show
• 3:36
  notes, Authenticate Con Co, n.com is where you can go to
• 3:40
  find more information, make sure you get that hotel booked so you
• 3:42
  can stay. You know, at the resort that
• 3:44
  it's at, you don't have to like take an Uber that's always, that
• 3:47
  always sucks man conference. And you're like, it's not
• 3:50
  convenient. It's just it makes a world of
• 3:52
  difference to be right there rather than having to commute in
• 3:54
  every day. Absolutely, yeah.
• 3:57
  And it's also not like Vegas, where you can just walk from
• 3:59
  hotel to hotel. Right.
• 4:01
  But even that could be like a 45 minute walk just to come from.
• 4:04
  Hotel to another. Yeah, a. 150 degrees outside
• 4:06
  too, yeah. We're going to talk a little bit
• 4:09
  about identity standards and stuff.
• 4:12
  You were talking before we get started that you wanted to get
• 4:14
  provocative with it. I don't know how you get
• 4:17
  provocative with an identity standard, but I think you're
• 4:19
  going to try. If the podcast just cuts off
• 4:23
  unnaturally, we went too far and we said that was not family
• 4:27
  friendly. Yeah, or if you hear like
• 4:28
  awkward edits of me trying to like carve out, like, yeah, we
• 4:32
  probably shouldn't have gone there or something like that,
• 4:34
  so. Maybe I think we'll be okay, but
• 4:37
  why don't we get into it? We're going to talk identity
• 4:39
  standards today as a guest. We've got Justin Richer.
• 4:42
  He's the security and standards architect and he's the founder
• 4:45
  of Bespoke Engineering. Welcome to the show, Justin.
• 4:48
  Thank you so much for having me on.
• 4:50
  Thank you so much for joining us.
• 4:51
  We're going to talk a little bit about your identity background
• 4:54
  and just start peppering you with a whole bunch of standard
• 4:56
  stuff, cuz you've definitely been a major player in this
• 4:59
  space. One, I'm going to compliment you
• 5:01
  again on your audio setup. You've got the nicest mic I
• 5:04
  think we've had yet on the show. You've got your whole audio
• 5:08
  setup. I know you do music.
• 5:09
  We're going to talk a little bit of that later.
• 5:11
  But I really appreciate it and it and I mentioned this before,
• 5:15
  we hit record the breath control and the mic technique.
• 5:19
  This is an audio podcast, but we have video that we run behind
• 5:22
  your the scenes just to kind of you know, help us kind of
• 5:24
  coordinate who's talking and stuff like that and for those
• 5:27
  who aren't familiar. You know, when you're talking
• 5:30
  into a microphone like we are, you want to try and get away
• 5:33
  from, like, mouth noises, right? And breath sounds, like, right.
• 5:36
  That kind of thing. And we were like getting prepped
• 5:39
  and like going through our preflight checklist, right?
• 5:41
  And all this stuff. And I noticed that as you were,
• 5:44
  as we were talking, you like, put your head to the side and
• 5:47
  like, did your exhale so it would go around the mic.
• 5:51
  Chef, kiss my man. Thank you so much.
• 5:54
  Happy to help, but yeah, I did radio back in high school and in
• 5:59
  college and we didn't have nearly as nice a gear at the
• 6:05
  little College Station. So in order to not completely
• 6:09
  trash the on air sound, you learned a few things about how
• 6:13
  to clean up the signal. Yeah, for sure.
• 6:15
  I go back and occasionally I listen to the first episode of
• 6:18
  this podcast. It's on a condenser mic.
• 6:22
  It was a blue Yeti, I think it was very echoey basement, no
• 6:28
  sound treatment. I mean it sounded fine for you
• 6:31
  know, we had no idea what we're doing.
• 6:32
  And then you Fast forward now it's like okay now we we still
• 6:35
  don't know what we're doing but at least it sounds a little bit
• 6:37
  better. So gives us a little more
• 6:39
  credence of that. Let's talk a little bit about
• 6:42
  your I M background because you have definitely been really.
• 6:46
  At the ground level of a lot of the stuff that a lot of
• 6:49
  organizations use for authentication, potentially some
• 6:52
  authorization stuff, but we always like to have a little bit
• 6:57
  of the origin story when it comes to identity.
• 6:58
  For our first time guest, how did you get into the Identity
• 7:02
  and Access Management field? Is it something that you chose
• 7:05
  or did it choose you? It definitely chose me, so my.
• 7:11
  My research background back when I was in undergrad was actually
• 7:14
  in collaboration systems. So getting people to work
• 7:17
  together to talk together a field that eventually became
• 7:21
  known as sort of, you know, social computing.
• 7:24
  And that led into the whole web, 2.0, blogs and wikis and
• 7:27
  everything else when all of that was new.
• 7:31
  But in working with all of those systems, you know, obviously you
• 7:36
  need to be able to identify people, you need to be able to
• 7:38
  connect systems together, You need to.
• 7:41
  Have security on all of these things or else it just you know
• 7:44
  stuff doesn't work. And I was finding that through
• 7:47
  all of these projects, you know as a you know an impetuous young
• 7:51
  engineer I would build the thing put it out and then our info set
• 7:54
  group at the place where I work to be like, yeah, no, turn off
• 7:58
  all of the functionality and that's that makes it secure.
• 8:01
  And it's like that's you know you're you're missing the point
• 8:03
  like that's the the point is to go do all of the things that
• 8:07
  we're doing and. After going through that
• 8:10
  experience a few times, I realized that, you know, I
• 8:14
  really should learn what the security side is looking for and
• 8:19
  sort of get involved in that space.
• 8:20
  And that's how I got involved with kind of looking at things
• 8:24
  with a security and access and all of that mindset.
• 8:30
  But as a consequence, because I kind of fell backwards into that
• 8:32
  space, I tend to approach a lot of security architecture in a
• 8:37
  way of looking how can we get. The most functionality possible
• 8:42
  and still make it secure. So focusing on that
• 8:45
  functionality side of things and it's like okay, this is what we
• 8:48
  want to do, this is what we need to do and how do we actually,
• 8:52
  you know, make that function secure As opposed to how do I
• 8:57
  shut off as much as I can in order to make it as secure as
• 9:00
  possible Because at the end of the day, a system with tons of
• 9:06
  security and no functionality is useless.
• 9:09
  But a system with tons of functionality and no security is
• 9:11
  the most popular app that everybody has ever used, right?
• 9:15
  And then this is this is just true time and time again.
• 9:18
  Yeah, and I find also to like bad security is like a rock and
• 9:21
  a river. People will just find a way
• 9:23
  around it. And Oh my gosh, yes, it's the in
• 9:26
  the workarounds often tend to be much worse than the thing that
• 9:30
  you were trying to prevent in the 1st place.
• 9:32
  You know, we tell people like. You know, come up with a
• 9:37
  complicated password that means people are just going to write
• 9:39
  it down because they're not going to remember it.
• 9:42
  And all of these things end up working counter towards the goal
• 9:49
  of the security engineering, like what you were actually
• 9:52
  trying to do, because it gets in the way of people actually doing
• 9:56
  things. And I think that that kind of
• 9:57
  disconnect is a real problem in our industry on the security
• 10:01
  side, on the identity side, people aren't often looking at.
• 10:06
  Sort of their little slice of the world in a bit of a vacuum
• 10:11
  and trying to figure out, like, OK, so how can I make my little
• 10:14
  bit the best that it can be without looking at the larger
• 10:17
  context of where everything comes together?
• 10:20
  In my opinion, there's a there is an academic paper that should
• 10:24
  be required reading for everybody, and that's it's from
• 10:29
  1988 and it's Gruden at all. Why collaborative?
• 10:35
  Computer supported collaborative work systems fail, and in this
• 10:40
  paper they look through a digital calendaring system that
• 10:43
  was bought by the management of a company and then handed to the
• 10:47
  admins. And as far as the management was
• 10:50
  concerned, it had all of the features and everything that
• 10:53
  they cared about. It was brilliant.
• 10:54
  But the admins who would actually manage all of the
• 10:56
  calendars and that were like putting things in for these
• 11:00
  executives. It was atrociously bad.
• 11:03
  And this disconnect between the people that are sort of
• 11:09
  designing and selling the system and the people that actually
• 11:12
  have to use it to do something at the end of the day was just
• 11:17
  insurmountable. The entire system was a massive
• 11:19
  failure and led to the writing of this paper and and in in my
• 11:26
  in my opinion this paper should be like day one reading of
• 11:29
  anybody getting in to really any type of.
• 11:33
  Human facing computing at all. You know, just as you're talking
• 11:38
  about this, I'm also thinking of kind of the security architect
• 11:43
  mindset almost has to be creative in a way, right?
• 11:47
  It goes beyond just, you know, it's not like a type, a
• 11:52
  personality type, a personality kind of.
• 11:56
  I don't want to say it as excluding people, but really you
• 12:01
  have to. Be able to use that left half of
• 12:03
  your brain mm. HM Yeah, Because you need to be
• 12:06
  able to think in sort of all of the weird ways that people are
• 12:10
  going to use the system or apply it to things that you can't
• 12:16
  expect and be able to adapt to that.
• 12:19
  And, you know, that's. Because, you know,
• 12:24
  fundamentally, identity systems are all about where this stuff
• 12:29
  starts touching people, where it starts dealing with people.
• 12:32
  And people are weird and squishy, and we do things that
• 12:36
  are, like, really unexpected. And so when you're designing a
• 12:39
  security architecture, you have to account for that weird and
• 12:42
  squishy stuff. Yeah, two of the things that I
• 12:46
  used to do when I was doing some software engineering.
• 12:51
  Courses and having to write some programs was I'd find that
• 12:56
  sometimes my brain was very active and I had to have like a
• 12:59
  notebook nearby. I had to keep a notebook next to
• 13:02
  my bed because I could wake up in the middle of the night with
• 13:04
  the solution or be going, you know, drinking, you know, a lot
• 13:08
  of caffeine. And my mind would just become so
• 13:11
  active in the ability to kind of solve some of these problems.
• 13:14
  I'm wondering, is that what you experienced as well?
• 13:18
  Yeah, I find that the the ability to kind of background
• 13:23
  process hard problems is really important when especially when
• 13:26
  you start getting up into sort of the architecture level of
• 13:30
  stuff, when you're looking at systems and systems of systems
• 13:33
  and how stuff comes together, there's there's a lot of stuff
• 13:36
  that you're not going to notice right away.
• 13:41
  But. If you engage in with the
• 13:44
  problem space, you're going to kind of keep thinking about it.
• 13:47
  You're going to kind of like keep percolating on it.
• 13:50
  And then you'll come up with sort of these, you know,
• 13:55
  interesting and creative approaches to things that you
• 13:59
  wouldn't have if you were just sitting at a desk saying, I am
• 14:02
  solving this problem right now. And so for for my part, you
• 14:07
  know, I'm, I'm an independent consultant.
• 14:09
  I have worked from home for the last eight years.
• 14:12
  So for me the the whole switch to virtual meetings meant that
• 14:17
  everybody else was also working from home during all of these
• 14:20
  meetings that it didn't really change that part for me.
• 14:23
  But what I've found personally helpful is I I ride my bike a
• 14:29
  lot. I I do, you know between 10 and
• 14:32
  20 miles a day. To just get out there, clear my
• 14:36
  head and let things just kind of background process and that type
• 14:42
  of contemplation I think is not really valued enough in the
• 14:50
  technology industries nearly as much as it should be because
• 14:53
  that's that's where creativity happens that's where this kind
• 14:56
  of like. You know, I got an idea of a way
• 15:00
  that I might be able to approach it.
• 15:01
  I don't know if there's something there yet, but when I
• 15:04
  get back to my desk, I'm gonna, I'm gonna try this thing that I
• 15:08
  hadn't thought of before. And you see where that goes, See
• 15:12
  where that lands us. You know, I think this is this
• 15:16
  is really interesting topic because I feel like we
• 15:18
  scheduled. We get so busy during the day,
• 15:22
  right? You're jumping from meeting to
• 15:23
  meeting to meeting and there's no time to think.
• 15:25
  It's just I'm reacting all day long, right?
• 15:28
  Absolutely. Yeah, I think it's important to
• 15:30
  to, I hate to say it, but schedule time to think, right?
• 15:33
  Maybe if you it's bike riding for me, it might be playing
• 15:35
  video games you know, whatever it may be, right?
• 15:38
  Inspiration can kind of come wherever.
• 15:40
  But we don't. I I feel like it's a trap that a
• 15:43
  lot of us get into is we don't actually take the time to think
• 15:46
  about something. Yeah, absolutely.
• 15:49
  And it's something that I've had to explain to some of my clients
• 15:54
  over the years is just like, well, you know, I am, I am going
• 15:58
  to basically, you know, get up to speed on this project, which
• 16:01
  means I'm going to go and read a bunch of stuff and think about
• 16:05
  it and that takes time. That doesn't seem like that
• 16:08
  would be a billable activity. But me actually writing a
• 16:12
  document for you or developing software or, you know, giving
• 16:17
  you guidance on how to engage with something, none of that can
• 16:21
  actually ever happen unless I can get to the state where, you
• 16:27
  know, I have had a chance to think about things.
• 16:30
  I have had a chance to start to piece these things together and
• 16:34
  be able to bring that forward. So yeah, if you need to schedule
• 16:38
  time to think, absolutely do it. I like I I encourage it Back
• 16:42
  when I had, back when I had a real job, I used to block out
• 16:46
  parts of my day to to just not be in meetings constantly and
• 16:54
  highly encourage people to do that.
• 16:56
  You know value your own time. And the other thing that took me
• 17:01
  way too long to figure out in in sort of the corporate space.
• 17:05
  That you don't have to go to every meeting you're invited to.
• 17:08
  Sometimes you can just not go, and it feels wrong.
• 17:12
  But you know what it Sometimes you're more valuable not being
• 17:18
  at the meeting. And that's a really hard lesson
• 17:22
  to learn because we're told like, oh, you have to be there.
• 17:25
  You have to be in the room when it happens.
• 17:27
  The thing is, like most meetings is not where things happen,
• 17:31
  right? That's that's not really what
• 17:33
  meetings are, are. Are good at meetings are not
• 17:37
  about getting things done. Meetings are about sort of
• 17:40
  getting a direction, getting some cohesiveness and then you
• 17:44
  get out of the meeting and get things done.
• 17:46
  And so you got to make sure that you have the time to get things
• 17:50
  done and that's that's really, really important.
• 17:54
  Yeah, I I I think we probably just end the show right here.
• 17:57
  The the sound clip it, you know, sound bite is meetings are not
• 18:01
  where you go to get things done. Yeah, There we go.
• 18:04
  Done. Thanks for listening, everyone.
• 18:06
  And yeah, we'll go for the next one.
• 18:08
  No, no, I think you're totally right on.
• 18:10
  You know, I think a lot of people don't understand that
• 18:14
  they control their own schedule, right?
• 18:17
  And you need to be able to control it.
• 18:19
  Or they're told that they don't control their own schedule.
• 18:21
  Right. And I think sometimes can be
• 18:22
  challenged, especially for maybe people who are newer in their
• 18:25
  careers, newer with an organization, you want to make a
• 18:27
  good impression and blah blah, blah, right?
• 18:30
  But I think I'm with you. It's like, you know the.
• 18:32
  The the older I get and yes, the higher I go up with an
• 18:35
  organization, I feel like I do have more control over things.
• 18:38
  Sometimes I don't. I have less control because
• 18:40
  sometimes there are things like, no, you have to be there.
• 18:41
  And 100% it is going to be a waste of my time, but I need to
• 18:46
  be there, so be it, right. Those are there will always be
• 18:49
  those. But yeah, I think this is
• 18:50
  something I talk about with my team.
• 18:52
  Jim knows this as well as you know, you control your schedule.
• 18:55
  It's okay to say no. I had a manager once, very long
• 18:58
  time ago, my food service career.
• 19:00
  The customer is not always right.
• 19:02
  Absolutely. So it's it's funny that it, it's
• 19:06
  fascinating to me that you brought up that phrase because
• 19:08
  one of the things that I did learn, so I previously worked
• 19:11
  for a company called Miter for 15 years.
• 19:14
  They're a big systems engineering company, do a lot of
• 19:16
  research for the US federal government.
• 19:18
  And one of the things that I really got to learn while I was
• 19:23
  there at Miter was that the customers that we were talking
• 19:27
  to, it was. They would come and tell you
• 19:31
  what they wanted you to make, right?
• 19:34
  I need you to build this system. But the thing that the customer
• 19:37
  says, the thing that the customer wants and the thing
• 19:40
  that the customer needs are three very, very different
• 19:44
  things. But it was really impressed upon
• 19:47
  us, in my group at least, that it was our job to be able to
• 19:50
  figure that out and be able to articulate to the customer that
• 19:54
  like, well, hey, OK, you, you said you needed something that
• 19:57
  did this. But your actual problem that
• 20:02
  we're seeing is actually more like this.
• 20:05
  And so we're looking at doing this type of thing.
• 20:08
  And because we were a research arm, we could be a, you know, a
• 20:11
  little bit more like, hey, here's a weird thing that we, we
• 20:15
  think is going to address something and here's why.
• 20:17
  And our customers were a little, little more accepting of that.
• 20:21
  But you know, you you need to be able to at least tell the
• 20:25
  difference between those things and be able to tell that story.
• 20:28
  A diplomatic customer friendly. Absolutely, absolutely.
• 20:32
  One of the other things that I that I'm really grateful for.
• 20:36
  You know, my my department head at MITRE taught me that it
• 20:40
  doesn't matter how right you are if nobody's listening to you.
• 20:44
  And that as a you know, hot headed young engineer, that was
• 20:48
  a really hard lesson for me to learn in my 20s and it took took
• 20:53
  me a long time and I'm still learning it, I'm sure.
• 20:58
  It's a but it is absolutely a journey.
• 21:00
  It is absolutely a journey. But, you know, you need to be
• 21:03
  able to bring people along on that story and be able to sort
• 21:08
  of engage with people that it's not just hi, here's the
• 21:11
  solution. Shut up and do it.
• 21:12
  It's hi, here's the solution and here's here's why I care.
• 21:16
  Here's why you care and figure that out.
• 21:20
  Especially especially in cases where.
• 21:24
  You're going to be wrong in some way or another and you just
• 21:27
  don't know how yet. And so being able to have that
• 21:32
  conversation of like yes we need to do this and have somebody be
• 21:35
  like but that's going to break my database and it's like okay,
• 21:39
  why is that going to break your database.
• 21:41
  Let's let's figure that out and and it it may upend the entire
• 21:47
  set of you know. Poorly defined requirements that
• 21:50
  you were working with in the 1st place.
• 21:51
  Or it may just be a little tweaked to something you don't
• 21:54
  know until you have that conversation.
• 21:56
  I wanted to throw out a couple since we're all sharing Nuggets.
• 21:58
  I think some of the one of the early career Nuggets and it kind
• 22:02
  of goes with the you don't have to be in every meeting is that
• 22:06
  it's better to be known for one really awesome thing instead of
• 22:10
  a couple of mediocre things you know.
• 22:13
  So if you get so spread out it's like, yeah, you're on every
• 22:15
  project and. We all go okay, that's not as
• 22:19
  good as like, hey, you're on this digital identity project
• 22:22
  and it was awesome. Like it changed the way the
• 22:25
  organization works. That's my experience.
• 22:27
  Anyway, #2 later in your career is kind of, I guess, know
• 22:33
  thyself, know what really gets you.
• 22:36
  So for me, digital identity if I focus on digital identity
• 22:40
  though. I'm probably not going to be the
• 22:43
  CEO of a major corporation, right?
• 22:44
  Probably not even going to be the CSO or the CIO, because I
• 22:48
  love digital identity so much. I want to focus on that.
• 22:51
  I want to talk about that. I want to have a podcast on that
• 22:54
  and nobody. Will listen to.
• 22:55
  That, but that's what makes me happy.
• 22:58
  Right. Right.
• 22:59
  And I feel good about what I do. And I I'm able to get up in the
• 23:03
  morning and have energy for work.
• 23:07
  But and here's the third thing, this is not a career thing, but
• 23:09
  this is the life thing. Is even though we talked about
• 23:12
  like okay, you have to be able to have this time to think.
• 23:15
  You're also at some point need to shut off.
• 23:19
  I had a friend his his sage advice was everybody's got to
• 23:22
  waste some time. Maybe it's you know the the
• 23:25
  video games or whatever it is, but you you've got to have more
• 23:29
  interest than work and maybe everybody knows this.
• 23:32
  But if you're in that mode where it's like you work all day and
• 23:35
  then you plan your weekends around how you're going to get
• 23:38
  all your work done. Then your life's not going to be
• 23:40
  something you really look back on and you're like, yeah, I
• 23:43
  actually did something. You've got to have some some
• 23:47
  time. So you're building a a life.
• 23:49
  Anyway, I'll stop. There.
• 23:50
  No, I I absolutely agree. I have.
• 23:52
  I have three young kids and they definitely help keep me
• 23:55
  grounded. I've been lately been playing
• 23:59
  through the new Legend of Zelda game and my middle kid, they're
• 24:03
  ten years old. And they will just sit on the
• 24:06
  couch with me while I'm playing it and be like, oh dad, let's go
• 24:10
  that, oh, we need to go get this thing.
• 24:11
  And and like, they're not actually playing the game, but
• 24:15
  they are so engaged with it that that's like, you know, that's
• 24:18
  something that like it'll be getting towards the end of the
• 24:22
  day and I'll, you know, come up upstairs from my Home Office and
• 24:25
  they'll be like Zelda. And and it's just like, all
• 24:30
  right, give me 5 minutes to go deploy this thing and then yeah,
• 24:35
  then we'll then we'll go play and then 10 minutes later get a
• 24:38
  knock on my door. Dad, Zelda.
• 24:40
  And you know, it's it is absolutely important to be able
• 24:43
  to to do that kind of thing. 100% agree.
• 24:47
  It's definitely not a waste of time.
• 24:48
  We might think other people might say you're wasting your
• 24:51
  time, but it's actually well used time.
• 24:54
  Absolutely. And it all, it all comes down to
• 24:57
  how you measure value, right? What?
• 25:00
  What value are you getting out of the time?
• 25:01
  And all of your time shouldn't just go to creating value for
• 25:05
  somebody else's company. Boom mic drop.
• 25:09
  There it is. I no this I do not want to drop
• 25:11
  this microphone. I'm.
• 25:12
  Sorry, no, that's a very nice microphone.
• 25:15
  All right, let's get back a little bit on track because I
• 25:16
  love that conversation. But I do want to get a little
• 25:18
  bit more about some of the stuff you worked on and as a.
• 25:22
  Multitalented individual right? An identity.
• 25:25
  And Speaking of articulation, you've written a book in this
• 25:29
  area. It's called Oauth 2IN Action.
• 25:31
  It always fascinates me when someone can put pen to paper and
• 25:35
  actually have the, I don't know the the work ethic or whatever
• 25:39
  it is, sit down and write any set of book.
• 25:41
  But what was the impetus for creating that?
• 25:43
  And I guess for people who want to check it out, give me like
• 25:46
  the 32nd, like back cover synopsis for it because we'll
• 25:48
  have a we'll have a link in our show notes for this as well.
• 25:52
  Man. So yeah, the book creating it
• 25:54
  was was sort of an interesting story.
• 25:57
  I was actually approached by my coauthor, Antonio Sanso, who
• 26:03
  wanted to write this book, didn't want to do it himself.
• 26:07
  He's a security researcher at the time, he was with Adobe and
• 26:11
  he's working on Ethereum now or something like that.
• 26:13
  And but really, really, really smart guy, really smart security
• 26:20
  engineer. But he approached me like, you
• 26:23
  know, hey, there's there's kind of a hole in the market for a
• 26:27
  book about Oauth that actually takes things from start to
• 26:31
  finish and explains all of the different parts of it and why
• 26:34
  they work that way. And and I kind of at that point,
• 26:39
  I kind of looked around and I was just like he was, he was
• 26:42
  absolutely right. You know, the, the books that
• 26:44
  were out there were how to build an Oauth client that connects to
• 26:47
  GitHub, how to log in with Google.
• 26:51
  How to use the Facebook API. All of those were books that
• 26:54
  would teach you parts of Oauth but weren't teaching you Oauth
• 26:58
  for its own sake. And that's what we set out to
• 27:01
  do. So going through the reader
• 27:03
  learns, learns how to build a, you know, because I'm, I'm an
• 27:07
  engineer, I build things, you know, it's not real unless I'm
• 27:10
  building it. And so going through the book,
• 27:13
  you build an authorization server, you build a couple of
• 27:16
  different flavors of client, you build a resource server.
• 27:19
  And you connect them all together and they're all
• 27:21
  actually standards compliant, That we do have a banner in the
• 27:25
  book that says do not use any of this in a production system,
• 27:29
  please. And I have mostly held to my own
• 27:34
  advice on that. That's another story though, but
• 27:39
  we wanted people to be able to. Sit down, and even if you know
• 27:43
  in their day job, they're only using one tiny little bit of it,
• 27:47
  like they're just writing a client or they're just
• 27:50
  protecting an API. We wanted them to be able to
• 27:53
  know what all of the other moving parts were that were that
• 27:56
  were out there and why they were moving that way.
• 27:59
  Like, why do I have to do all these redirects and all of these
• 28:02
  backchannel calls and all of this other stuff?
• 28:04
  Why do I have to deal with authorization codes and Pixie
• 28:08
  and all of this other craziness? Because the danger is always
• 28:12
  somebody looking at a protocol like Oauth and seeing all of the
• 28:16
  moving pieces and going, you know what, that's really messed
• 28:19
  up. I can come up with something
• 28:21
  that is just as secure and way easier to build.
• 28:25
  And the truth is that it's like you can't.
• 28:28
  You know you're you're going to come up with something.
• 28:31
  It might be really, really clever, but it won't have had
• 28:34
  the kind of scrutiny that an international standard like this
• 28:38
  has and all of those. Bits and pieces are there for a
• 28:42
  reason. Is it always the best reason?
• 28:44
  No. But there is a reason behind it.
• 28:47
  And So what we wanted to do with this book was to bring people
• 28:53
  through everything that was there and sort of show them what
• 28:56
  the reasons were, that things worked the way that they the way
• 29:00
  that they did. So if I don't know anything
• 29:02
  about a lot too, can I put pick this book up and and have a an
• 29:06
  appreciation for it? Or is there some prerequisite
• 29:09
  knowledge that I need? No, I think you can.
• 29:11
  You can basically come in cold. We tried to, we tried to write
• 29:15
  it to an audience of people who had either heard of Oauth or
• 29:19
  we're told that they are using Oauth and needed to needed to
• 29:23
  start making sense of it. It used to be the case that the
• 29:27
  publisher put the first two chapters online for free.
• 29:30
  And honestly, I would say go go read those two and to give you
• 29:35
  an idea of how how the protocol sort of fundamentally works the
• 29:40
  way that it does. I do like the cover of like a
• 29:43
  pirate or I'm not sure what that's supposed to be.
• 29:46
  It's like he must be here or something.
• 29:48
  He is a. Croatian Rifleman, so this is
• 29:53
  part of the. Part of the branding of that
• 29:56
  particular series of books from this publisher is that they get
• 30:00
  very localized period costumes for people.
• 30:05
  And when Antonio and I were looking at the different options
• 30:08
  that they were presenting us with, well, the first one that
• 30:12
  we picked was this amazing illustration of this guy in
• 30:19
  LIKE. Full chainmail armor with like a
• 30:22
  4 1/2 foot sword out in front of them and we're like, yes, yes,
• 30:26
  that that's that's going, but apparently apparently the like
• 30:30
  the head publisher came back with no, that's the wrong
• 30:32
  historical period for this security book and we're like, we
• 30:36
  don't know why what. Does it even mean I?
• 30:39
  Know exactly. So we we went with a second
• 30:42
  option which was this guy and he's.
• 30:46
  A Rifleman from a village in Croatia.
• 30:49
  I'd have to, I'd have to go back through my archives to to get
• 30:53
  the information of where. But yeah, that was, that was
• 30:58
  apparently the sort of the the local dress for like you know
• 31:05
  the militia and guardsmen and and stuff like that at the time.
• 31:09
  I like it. I dig it.
• 31:10
  Check it out in our show notes. And the mustache.
• 31:13
  But it is, and like the bandana anyway.
• 31:17
  The the next thing I want to ask about is Cards Against Identity,
• 31:20
  which is probably the opposite of serious Oauth 2 talk, but has
• 31:25
  taken the Identity Identity industry by storm I would say.
• 31:30
  A very small storm, but yeah. What is Cards Against Identity?
• 31:34
  Well, I'm sure a lot of your listeners will be familiar with
• 31:37
  the game Cards Against Humanity. It is a party game that.
• 31:41
  Really kind of came to prominence about a decade ago, I
• 31:43
  think at this point. And the the conceit of the game
• 31:48
  is that one person basically lays out a prompt and everybody
• 31:52
  else that's playing provides an answer to fulfill that prompt.
• 31:56
  And it became famous because it took that basic game mechanic
• 32:01
  and just made it really raunchy and funny and just.
• 32:05
  It's with the right group of people.
• 32:07
  It is absolutely hilarious. Raunchy is not even approaching
• 32:10
  the level of. That's.
• 32:12
  Hilarious filth that is part of this.
• 32:15
  I have played some some third party expansion decks that make
• 32:19
  this one look almost kid safe. Try explaining to your
• 32:23
  stepmother what certain things are.
• 32:26
  In the middle of the game. I absolutely have a story about
• 32:29
  that, but I don't think it is appropriate for this podcast, so
• 32:32
  maybe I'll catch you guys. After right of that game,
• 32:35
  absolutely. Regardless, that's Cards Against
• 32:37
  Humanity, the base game. And so one of the things that
• 32:40
  they do with copies of this game is that they will send you a
• 32:43
  bunch of blank cards so that you can basically put in your own
• 32:46
  house rules and things like that.
• 32:48
  And there was a group of people that were floating around the.
• 32:55
  You know the identity conference circuit that had started to
• 32:59
  collect a bunch of these house cards that had identity themed
• 33:03
  jokes on them. And so one of the answer cards
• 33:06
  was the entire, the entire WS Star documentation, which is a
• 33:11
  horrifying, you know, answer to anybody who's ever had to touch
• 33:15
  WS Star and so. I got invited to one of these
• 33:21
  card games at the Cloud Identity Summit way back in the day, the
• 33:25
  predecessor to Identiverse, and it was an absolutely hilarious
• 33:30
  game or like people were dying laughing.
• 33:33
  It was it was amazing to just be in a room with all of these
• 33:38
  brilliant identity nerds making horrible, horrible jokes with
• 33:42
  each other and and it was a great time.
• 33:45
  So Fast forward a few years. And I was actually working on
• 33:50
  publishing a board game I had run a I think at that point I
• 33:55
  had just started to set up a Kickstarter for it was going to
• 33:59
  launch it. That game is called Gridlock
• 34:02
  Boston and it's you can find it under the bespoke website or I'm
• 34:07
  sure we can drop a link in the info bar too.
• 34:10
  But as I was working on prototyping that game I realized
• 34:15
  that the. Small publisher that I was using
• 34:20
  could just print cards. And then I had the idea one day,
• 34:24
  like I could make Cards Against Identity an actual real deck.
• 34:29
  And so I got out my draftsman's ruler and, you know, tried to
• 34:34
  calculate the font pitch and the spacing from the margins and all
• 34:38
  of this other stuff to get cards that could match as closely as I
• 34:42
  could get them to the base Cards Against Humanity game.
• 34:45
  And then I. I came up with a bunch of cards,
• 34:50
  some of which were from that house deck that I remembered,
• 34:54
  like the WS Star documentation is in there in the initial deck,
• 34:58
  and then added a bunch more of my own that I thought was
• 35:02
  hilarious. Like one of Ian Glazer socks is
• 35:05
  one of the favorite ones from the first year and really just
• 35:09
  tried to try to just have a lot of fun with it.
• 35:11
  And to me it was going to be just this is a oneoff project,
• 35:13
  this is ridiculous and we're just going to we're going to do
• 35:16
  that and. Whatever I brought it to, I
• 35:21
  think it might have been identifiers at that point.
• 35:23
  And somebody who lived in the area was actually having a a
• 35:29
  party the day before, a house party the day before the
• 35:33
  conference started. So I was there with my box of
• 35:37
  cards, and I sold out my box of cards that I had printed at that
• 35:41
  house party. Now I'd only printed like, I
• 35:44
  want to say like 30 copies or something like that, 20 or 30
• 35:47
  copies. And so, you know, it wasn't that
• 35:50
  many, but I was just like, wait, people actually want that?
• 35:54
  I figured I would just be like, shuffling this around to A to
• 35:57
  like a couple of my friends and I'd be going home with half of
• 35:59
  this box. But yeah, no, it it it sold out
• 36:03
  before the conference started. And I realized like there, there
• 36:06
  might be something interesting here.
• 36:08
  And so almost every year since then, I've tried to.
• 36:12
  You know put together a new deck that I release each year and
• 36:18
  with jokes that I find interesting and topical.
• 36:21
  Some people will write to me with an idea or you know I I get
• 36:26
  Dms on the ID Pro Slack every now and again of like hey, this
• 36:29
  would be a great card for next year and try to try to work them
• 36:33
  in when when they make sense and.
• 36:37
  Yeah, I've been I've there have been 4 editions.
• 36:40
  Now I'm planning on doing another one next year and it's
• 36:43
  it's it's a blast. My favorite experience with the
• 36:46
  game though has to be at the Oauth Security Workshop last
• 36:50
  year because I brought at that point the three decks that have
• 36:55
  been published of Cards Against Identity and somebody brought
• 36:59
  their base game of Cards Against Humanity, which allows you some
• 37:02
  wonderful combinations, like you know the question card of why is
• 37:06
  mommy crying? And you can answer that with
• 37:09
  SAML, right? It just amazing bits like that.
• 37:13
  And so here, here we were, a bunch of drunken security
• 37:18
  engineers playing this game and just falling over, laughing at
• 37:24
  ourselves because it was just so absurd, so funny, and probably
• 37:29
  one of the best times I've ever had at a conference.
• 37:31
  It was, it was a great time. I can't believe I'm going to do
• 37:35
  this, but I'm going to waste one of my questions.
• 37:37
  Definitely lets me ask so many questions per episode, but I'm
• 37:40
  going to ask what is WS Star for people who didn't live through
• 37:45
  that? Oh my gosh.
• 37:47
  So imagine that you're trying to solve security by writing
• 37:52
  documents that only can be read by automatically generated
• 37:57
  document readers. So you actually have to write
• 38:01
  code that writes the code that reads the code that your code
• 38:03
  wrote. And in a nutshell, that's that
• 38:09
  is security based on WS Star. It's the web security family of
• 38:12
  standards and there's a lot of great concepts in there that
• 38:16
  live on today. Oauth in a lot of ways is is a,
• 38:21
  you know an actual functional and usable version of some of
• 38:25
  the delegation patterns in WS Star.
• 38:28
  You know and Sam will take some of the the.
• 38:32
  Assertion patterns and stuff from WS STAR, but WS STAR itself
• 38:36
  is just one of those things that is like so complex.
• 38:40
  End to end. It is, it is nearly inscrutable.
• 38:46
  And so with with the joke card being the WS STAR documentation,
• 38:52
  it's it's a terrifying thing to ever be handed to read.
• 38:57
  So I know that you are a musician.
• 39:02
  A game designer? An author?
• 39:04
  A security and standards architect?
• 39:06
  So what's the common thread there?
• 39:08
  I get interested in a lot of things and I've been very lucky
• 39:11
  to be able to pursue a bunch of those.
• 39:14
  A lot of the common thread though, I think is these are
• 39:19
  things that that encourage a creative approach and like we
• 39:24
  were talking about earlier, I believe with.
• 39:28
  You know, architecture, security, architecture really
• 39:31
  kind of takes a takes a creative mindset.
• 39:35
  You know that that ability to contemplate that ability to
• 39:38
  think of how things might go wrong or might go right and what
• 39:41
  does that mean in that context? You really need to be able to to
• 39:47
  create those worlds in your head and also share those worlds with
• 39:52
  the other people that you were working with.
• 39:56
  And that takes a certain amount of creativity.
• 39:59
  The other thing that they have common is that they all work
• 40:01
  within constraints. So you know, a book has like a
• 40:06
  technical book, especially you've got chapters and indices
• 40:09
  and examples and things like that music, you've got scales
• 40:13
  and modes and forms and timbre and all of this other stuff.
• 40:16
  Game design is literally all just math and spreadsheets under
• 40:19
  the hood, even if if you don't realize it.
• 40:23
  Like writing a board game is sitting down and doing a lot of
• 40:27
  weird math to make sure that nobody playing your game feels
• 40:30
  like they're doing weird math. So it's kind of like the
• 40:34
  creative side of like, I wanna create this cool thing and I
• 40:38
  say, wait, how do I create it exactly?
• 40:40
  And then figuring that out. Within the constraints of the
• 40:43
  system that you're applying it to, yeah, absolutely.
• 40:47
  That makes a lot of sense to me, so I wrote this next question
• 40:50
  last night. Now, it kind of sounds a little
• 40:52
  weird, but I'm going to ask you or state it anyway.
• 40:55
  Have you have you seen the movie The Godfather?
• 40:58
  Yes. And I guess who has, right.
• 41:00
  So I was going to say you're kind of like the Don Corleone of
• 41:05
  or Corleone of Open ID Connect and.
• 41:10
  Well, well, so OK, like I said. I'm curious to see where you're
• 41:13
  going with this one. So then I thought of this
• 41:16
  earlier today was do you remember the scene where Luca
• 41:20
  Bravi, Luca Brazi sits down with Don Corleone and he's very
• 41:26
  nervous. He's almost like reading from a
• 41:28
  piece of paper. Don Corleone.
• 41:30
  You. Came up with many good standards
• 41:34
  for the Open ID Connect standard.
• 41:37
  Don Corleone, you've written many good aspects to the Oauth 2
• 41:42
  standard, and so where I was going with it was this is
• 41:49
  terrible. I wonder where this is going
• 41:51
  myself. So This is why the pitch count.
• 41:54
  If you wouldn't edit it right to this part, it would be Don
• 41:59
  Corleone. If Open ID Connect was being
• 42:02
  written anew today, how would it be different?
• 42:07
  That is a great question. Because right there.
• 42:13
  Well, no, I'm, I'm going to be honest, I'm struggling to see
• 42:17
  where The Godfather fits in with her, even though I did have a
• 42:21
  Godfather quote in the in the last presentation I gave at
• 42:24
  Idanaverse this year. The whole, you know what happens
• 42:27
  when standards meet the real world?
• 42:29
  It's like look at how they massacred my boy.
• 42:33
  But yeah, I I will say starting off, I, you know, I was part of
• 42:38
  a large group of very smart people who worked on all of
• 42:41
  these things. I was very lucky to be in the
• 42:43
  right community at the right time to be able to work on this
• 42:46
  stuff. And you know, I'm, I'm far from
• 42:49
  the only voice and lost a lot of arguments in in all of that
• 42:53
  spaces. So that said, I think that if we
• 42:57
  were building Open ID Connect in Oauth today, it would definitely
• 43:00
  look different because it does look different today than it did
• 43:06
  a decade to a decade and a half ago when we started.
• 43:09
  There are features that have been sort of grafted in to both
• 43:13
  of these protocols that weren't there before.
• 43:16
  So there's a pattern that's now becoming more well known called
• 43:21
  intent registration. And intent registration
• 43:25
  basically allows the client software to say this is what I'm
• 43:29
  about to do and do that, do that bit in a secure way so that when
• 43:37
  you then go and step and start talking to the users, then you
• 43:42
  can actually sort of deal with all of that sort of squishy user
• 43:47
  space. Without having to worry about
• 43:50
  somebody mucking up that initial request of this is what I'm
• 43:53
  about to do. In the Oauth world, that and
• 43:56
  Open ID Connect to that is implemented with something
• 43:58
  called a pushed authorization request.
• 44:01
  If we were building these systems today, I honestly think
• 44:04
  that we would just always use that and that and that is that
• 44:08
  is in fact the advice of the Fappy Working Group.
• 44:12
  A high security profile of Oauth and Open ID Connect is to always
• 44:17
  use that. Because there's a lot of
• 44:19
  benefits from doing intent registration and asking that
• 44:24
  question of like what would it look like if we built a system
• 44:28
  today That was a lot, a lot of the engineering behind GNAP, the
• 44:32
  grant negotiation and authorization protocol, which is
• 44:36
  in i.e. SG review in the ITF standards
• 44:40
  body, which means it's it's close to done.
• 44:43
  And what we tried to do with that project was take a step
• 44:47
  back and say like, okay. Regardless of how how you do
• 44:50
  things in Oauth, what are the best practices and best patterns
• 44:54
  and things, and can we actually make this all kind of fit
• 44:57
  together? So another thing in the Oauth
• 45:01
  world is that when you're calling an API, you have a set
• 45:04
  of scopes. Those scopes limit what the
• 45:06
  resulting tokens can do. And it was brilliant innovation
• 45:10
  for 2010. Because previous to that it was
• 45:15
  either you get the whole API or you don't, right?
• 45:18
  So scopes absolutely brilliant and work great.
• 45:22
  Well today we've now got an extra decade of delegated API
• 45:27
  access and people are realizing, like, I want this token to be
• 45:31
  able to spend $5 within the next month, but not more than that
• 45:37
  and at least $0.50 at a time. And being able to like really,
• 45:43
  really dial in that kind of stuff and be able to ask for
• 45:47
  that kind of thing and associate those kind of rights with these
• 45:51
  access tokens. And so in GNAP, we came up with
• 45:57
  a structure that allowed us to express that.
• 46:00
  And then I actually worked with a couple of other folks, Brian
• 46:04
  Campbell and Torsten Loterstadt. To back port that to Oauth 2 and
• 46:08
  that recently became an RFC of rich authorization requests.
• 46:13
  And so in addition to scopes in Oauth, you can now say like
• 46:16
  these are the actions I want to take at this location with these
• 46:19
  data types. And actually also just you know,
• 46:23
  customize that to whatever API it is that you're protecting and
• 46:27
  so you can say things like. You know, I I need to do this
• 46:32
  amount of, you know, this amount at this time or or whatever you
• 46:36
  need to do. And I think we would have that
• 46:39
  kind of stuff just baked in from the beginning because we've
• 46:43
  learned more of sort of how this stuff gets used and and how
• 46:47
  people want to use it. I think that everything you just
• 46:51
  said there was, it's like, those are so many amazing concepts and
• 46:57
  I also think like, okay. You push out a standard or
• 47:01
  you're working on a standard, it gets published.
• 47:05
  What if it doesn't get adopted? Does that indicate whether or
• 47:09
  not you were successful? Or are there other measures of
• 47:14
  success of publishing a standard?
• 47:17
  There are a lot of ways to measure success, and some of
• 47:21
  the, you know, some of the best things that a standard can end
• 47:25
  up doing is being an organ donor for something else.
• 47:29
  You know, you get a concept and it might be brilliant and it
• 47:31
  might work right, but it might not be packaged in quite the way
• 47:35
  that people can actually use. Going back to WS Star that, you
• 47:39
  know, we were making fun of a bit earlier today, there were a
• 47:42
  lot of good concepts in that and being able to sort of talk about
• 47:48
  security in a in a systematic way was.
• 47:54
  Not exactly new, but the way that it was done was was kind of
• 47:57
  new. It was just an absolute disaster
• 47:59
  to actually use. So a lot of people would say
• 48:05
  that, you know, because of that WS Star is a is a failed
• 48:08
  security system and by that measure it would be but and a
• 48:14
  lot of people have scars from that too.
• 48:16
  You know, by that measure it's also, you know, not successful.
• 48:19
  But The thing is we wouldn't be where we were today without that
• 48:23
  as a stepping stone. I don't think you know because
• 48:26
  we we have to learn these lessons somewhere.
• 48:29
  And so the ITF famously says that, you know, I TF doesn't
• 48:35
  pick market winners. You know it's it's not, it's not
• 48:39
  out there to to steer competition in One Direction or
• 48:44
  another. It's out there to create the
• 48:46
  best technical standards that there are.
• 48:48
  And if there is a market niche that that fits things, then
• 48:53
  that's great. If there's not, then you know
• 48:57
  the documents are there and their archive, they they may
• 49:00
  take life, they may take on life much later in a different space
• 49:05
  in a different way, or they may get sort of picked up, sliced
• 49:09
  apart and used in something else that you didn't anticipate.
• 49:14
  So I I think this could be a good segue into a listener
• 49:18
  question. So Mike Woodburn submitted the
• 49:21
  question. What are your thoughts on the
• 49:23
  current and future state of Uma? Are you seeing it being used?
• 49:27
  Does the current incarnation of Uma have legs, or is there a
• 49:31
  need for UMA 2.0? So I was an editor on UMA 2.0,
• 49:37
  so that already exists for like 5 or 6 years.
• 49:42
  So modifying that to UMA 3.0. I would say that UMA was one of
• 49:48
  those things that it really pushed the conversation
• 49:51
  especially about user to user delegation and how we represent
• 49:54
  that in in systems. And it really pushed a lot of
• 49:58
  the concepts and ideas forward in ways that were not being
• 50:02
  talked about elsewhere. It was packaged sort of together
• 50:07
  in such a way that was really hard to apply in a lot of spaces
• 50:13
  And so I would say by. By that measure, you know there
• 50:18
  are deployments of UMA, but they don't have the type of, you
• 50:24
  know, world reaching, cold boot capable distributed
• 50:27
  authorization promise that UMA is technologically capable of.
• 50:33
  That said though a lot of the design tenants of UMA went into
• 50:36
  GNAP, a lot of the design tenants of UMA are being sort of
• 50:41
  picked up in. Different ways in different
• 50:45
  different systems. So you know something that's
• 50:49
  that kind of branched out from UMA is the ability to, you know,
• 50:54
  very dynamically connect a resource server and
• 50:58
  authorization server. We're seeing some of that in in
• 51:01
  some of these, you know, more tightly coupled, more tightly
• 51:05
  regulated systems out there, not using UMA, not using quite all
• 51:11
  of that. Same tooling, but pulling a lot
• 51:15
  of the concepts in sort of new and different ways that that UMA
• 51:20
  introduced and did well with it but just didn't, didn't land in
• 51:26
  quite the same market kind of way.
• 51:29
  So I want to do 2 more listener questions because I think it's
• 51:35
  it's fantastic when listener send questions our way and
• 51:38
  please if you're listening and you've got some questions.
• 51:41
  Send them over. This one was specifically you
• 51:44
  for you from Mike. Again, it was.
• 51:47
  I'm not sure what he was driving at, but I'm sure he had
• 51:49
  something on it. What's your favorite star back,
• 51:55
  I guess like our back about? Our back back things like that,
• 52:02
  so. Please say baby, baby got.
• 52:08
  That's that's that's a great one.
• 52:12
  But I I actually have two answers to this.
• 52:16
  The first, the first, the more serious answer is is attribute
• 52:22
  based. Because I think fundamentally
• 52:24
  you can model all of these other systems using attributes.
• 52:28
  The problem of course is that attributes then have their own
• 52:31
  attributes and you get into attribute provenance.
• 52:34
  And how do I trust this attribute source and all of this
• 52:37
  other stuff and. It very, very, very quickly
• 52:40
  spirals out of control to the point where somebody says, you
• 52:42
  know what, screw it, just give me a roll, just just give me
• 52:45
  tell me which of these attributes is roll and I'll
• 52:48
  just, I'll just go from that. And so I love the promise of the
• 52:55
  system. In practice it's it's a little
• 52:58
  harder to deal with. I think some of the dynamic
• 53:00
  policy engines and policy languages that we're seeing
• 53:03
  happen today, you know it's going to help with that a lot.
• 53:07
  But you know, it's we've still got a long ways to go to make
• 53:11
  that really, really, you know, usable.
• 53:14
  I'm a fan of attribute based access control only as a
• 53:17
  starting point because I feel like a lot of companies, they're
• 53:21
  like, yeah you want to be role based and then they actually get
• 53:23
  into it a little bit and like wow, this is a lot harder than I
• 53:26
  thought it would be. And I feel like at least with
• 53:29
  the attribute you can get a kickstart and say okay well.
• 53:32
  Can you answer a basic question? Are you an employee or you're
• 53:34
  not an employee? Do you work in this location or
• 53:36
  somewhere else? Right.
• 53:37
  Those sorts of things as kind of a starting block only because I
• 53:41
  think it's easier to start there, but mileage may vary.
• 53:46
  Obviously the consulting answer is it depends.
• 53:48
  Absolutely. And you know, a lot of that
• 53:51
  comes with the sort of the nature of these computing
• 53:54
  systems and computing security systems.
• 53:55
  They're they're good at computing against these discrete
• 53:58
  models. Where if value is this or
• 54:00
  greater than this, then answer is yes.
• 54:03
  Which gets me to my true favorite, you know star back
• 54:09
  type system and that is CRBAC, the Cinnamon Roll Based Access
• 54:16
  Control. So there's a there's an old
• 54:21
  onion article from I think 2014. Where somebody just has this
• 54:26
  picture of this honestly rather mediocre looking cinnamon roll
• 54:30
  and they they are saying that oh, it is just too good.
• 54:33
  It is too perfect for this world, too pure.
• 54:35
  And it's it's this hilarious little bit of writing comedy
• 54:39
  that got picked up and sort of run with by the Internet at
• 54:44
  large. And the sort of the epithet of
• 54:49
  cinnamon roll is now being applied to people who are too
• 54:52
  good, too pure for this world. Like you're you're a good
• 54:55
  person. You're just you are a precious
• 54:57
  cinnamon roll. And so because of that, there
• 55:05
  that came to be, you know a bit of a joke in security circles
• 55:08
  that you know what, Why couldn't we have something that you know
• 55:12
  that the system. Like it.
• 55:14
  It knows that, oh, you're a precious cinnamon roll.
• 55:16
  Of course we'll let you in. And even though that it, you
• 55:19
  know, it is on the surface, it is a joke.
• 55:21
  That's how the real world works. Like, I couldn't tell you how
• 55:26
  many times I've been able to just like, you know, somebody
• 55:29
  just like gave me their employee discount because like we were
• 55:33
  chatting and they're like, yeah, I'll, I'll take the 5% off.
• 55:36
  You know, don't worry about it. And, you know, just nice little
• 55:39
  things of people being people to each other.
• 55:42
  Because we have the ability to kind of deal in that squishy
• 55:46
  space. I honestly think computers and
• 55:49
  computer security are going to have to address that space
• 55:53
  because that's how we model things in the real world.
• 55:56
  There's a whole thing in identity proofing, saying that,
• 55:59
  like, we need to move away from asking people what their
• 56:03
  birthday is, because all I need to know is if you're old enough
• 56:05
  to drink, right? But The thing is like.
• 56:09
  So. So I should be able to hand the
• 56:11
  bartender something and they check that yes, is old enough to
• 56:13
  drink. That's tested and verifiable,
• 56:17
  and we're good. Oh, that's great and all except
• 56:19
  that in the real world, you don't always get carded all the
• 56:24
  time. You don't get carded every time
• 56:26
  that the bartender you go back up to order a drink.
• 56:30
  If the bartender recognizes you or you fit the expectations of
• 56:34
  you're probably supposed to be here doing this thing then.
• 56:39
  You're probably not going to get checked.
• 56:41
  This is effectively Cinnamon rollbased Access Control.
• 56:46
  They're like you're somebody I don't have to worry about.
• 56:48
  I'm not going to get in trouble by selling you a drink.
• 56:51
  I get a good vibe from this and we'll be just fine.
• 56:54
  We'll we'll we'll be fine. And you know, this can slew on
• 56:59
  one side or another of the should this have actually gone
• 57:02
  through according to the formal rules of the system.
• 57:08
  You know, and this is, this is a space where I think that a lot
• 57:14
  of a I based modeling is going to open some really interesting
• 57:18
  doors, some terrifying doors, because suddenly we have a
• 57:23
  potentially nondeterministic security system.
• 57:26
  But we're already getting into that space with all of these
• 57:28
  risk engines that have all of these inputs that like nobody
• 57:32
  has all of that in their head at any given point.
• 57:35
  Like, nobody can tell me how Azure actually figures out when
• 57:38
  to prompt you for a password. Like, I guarantee you ask
• 57:42
  anybody on the Azure team and they're just like, there's the
• 57:44
  risk engine has it in there. There's I can show you all the
• 57:47
  inputs, I can show you the math, but like, nobody's sitting there
• 57:51
  doing all of that because that's what the computer is there for.
• 57:55
  That's what kind of scares me about AI overall.
• 57:59
  I mean, if you had some major financial crime take place.
• 58:03
  You know, I broke into a bank and I was able to transfer $10
• 58:06
  million and I never got prompted.
• 58:08
  And it's like, well, the system determined you didn't need to be
• 58:11
  prompted. That's not a good enough answer.
• 58:14
  Well, The thing is like you go into a bank and ask to ask to
• 58:18
  withdraw $10 million as a person.
• 58:22
  That request on its own is going to raise the risk and that's
• 58:28
  where these systems I think can really start to be smarter about
• 58:32
  it. You know, it's because the
• 58:34
  banker is sitting there going like, this feels kind of funny.
• 58:39
  Like, so I do all of my banking with a local bank here since
• 58:43
  since you brought up banking with the example.
• 58:45
  And the last time I had to go in to get a cashier's check for
• 58:47
  something, they were, they didn't ask for my ID like the
• 58:53
  bank manager. The bank manager knows me.
• 58:55
  She's just like, Oh yeah, how much do you want this check made
• 58:58
  out for? Yep.
• 58:58
  OK, you know, X number, $1000. Here you go.
• 59:02
  Have a good day. And she was just like Yep, no
• 59:06
  problem. It's in your account.
• 59:07
  I know who you are. This is fine.
• 59:09
  Which bank is that and where is that?
• 59:10
  At right, exactly. And.
• 59:13
  And so The thing is like, yeah, if you could convince Maria, the
• 59:17
  bank manager, that you're me, you deserve that money.
• 59:21
  Honestly, go for it. There's not a lot in.
• 59:23
  There I'm trying. Not a great example.
• 59:25
  I'm sure we come up with other examples.
• 59:27
  I just kind of feel like. If we're going to have
• 59:29
  algorithms in a I, some human being should be able to explain
• 59:33
  them. So in other words, like hey,
• 59:35
  what if I looked at your health insurance records or something
• 59:39
  and I didn't get, I didn't get prompted or something like that.
• 59:42
  So there is a scenario where maybe it does not fit that risk
• 59:47
  engine trigger. And and that's that is
• 59:52
  interestingly another space where I think that some of the
• 59:56
  recent developments in natural language AI are really going to
• 59:59
  come into come into play. Being able to query a system and
• 1:00:05
  say that like hey, you've got this policy, explain it to me,
• 1:00:10
  what is this doing? Why did you make that decision?
• 1:00:14
  So if somebody went and asked the bank manager like, hey, why
• 1:00:17
  did you just write that check? You know, if the if the regional
• 1:00:21
  manager had been in that day and they were just like, wait, why?
• 1:00:25
  Why didn't you ask for his license?
• 1:00:27
  Like why? Why did you just write that
• 1:00:28
  check? The manager could be like he's
• 1:00:30
  been banking here for 15 years. We know him.
• 1:00:33
  It's fine. You know, he used to live like
• 1:00:35
  walking distance from from the bank.
• 1:00:38
  Like you know, we we know this guy.
• 1:00:41
  Don't worry about it. It's totally fine.
• 1:00:43
  Just just watch and and being able to explain that is
• 1:00:50
  something that the human that made the decision does.
• 1:00:53
  Right now we're at the precipice of having systems that make
• 1:00:57
  these decisions that they can't explain themselves and we're not
• 1:01:02
  requiring them to explain themselves Because in you know,
• 1:01:06
  in that scenario if the regional manager was just like, yeah, no,
• 1:01:10
  never do that again For these reasons.
• 1:01:13
  You can change behavior and even if nothing bad had happened from
• 1:01:17
  that incident, that can be a learning experience for that.
• 1:01:20
  And then the next time that kind of thing happens, the bank
• 1:01:23
  manager could tell me like, Oh yeah, sorry, we need to ask for
• 1:01:28
  your ID because of, you know, such and such regulation or
• 1:01:32
  whatever. And it is, it's, you know, it's
• 1:01:35
  now policy that I have to enforce this.
• 1:01:37
  Yeah, sorry. I know it's annoying.
• 1:01:40
  She can explain it to me. As much as she can explain, she
• 1:01:44
  can explain the change of policy to me and the change of behavior
• 1:01:47
  to me. Right now we've got systems,
• 1:01:50
  whether they, they're AI driven or not, are doing absolutely
• 1:01:54
  inscrutable things to users and just firing off results and
• 1:01:59
  expecting people to deal with them.
• 1:02:01
  We have no insight into the underlying models that are, you
• 1:02:05
  know, moving us about the Internet on a daytoday basis.
• 1:02:10
  And I would like more insight into that.
• 1:02:11
  Personally, I I think that there's a lot of room for that
• 1:02:15
  type of thing. So one can even imagine a space.
• 1:02:18
  And I had a conversation with a with a colleague about this at a
• 1:02:22
  recent conference. One can even imagine a space
• 1:02:24
  where I implement a set of policy system a a set of
• 1:02:29
  policies in my system by just explaining to it what I want to
• 1:02:32
  get done and it will go and translate that to whatever
• 1:02:36
  policy language that I that I have.
• 1:02:39
  And execute that in the system. And then I say okay.
• 1:02:41
  Explain to me what you just did independently of what I put in.
• 1:02:45
  Explain to me what that is. And I can read that be like
• 1:02:48
  okay, that makes sense. And then I can take that
• 1:02:51
  explanation over to another system with a different policy
• 1:02:54
  language and say here's what we want.
• 1:02:57
  Like this is what I want out of this system and go through the
• 1:03:01
  same process. And the underlying formal
• 1:03:04
  language and modeling can be completely different in both
• 1:03:07
  cases. And we've got this sort of
• 1:03:11
  buffer of human language in between all of them.
• 1:03:14
  We're nowhere near there yet, but we're getting close to that
• 1:03:20
  in very, very interesting ways. All right, we got one more
• 1:03:23
  question. This is from another listener.
• 1:03:25
  This is from Marcus, who reached out to me.
• 1:03:28
  He shared this story and I figure this is a good one to get
• 1:03:31
  3 identity consultants to weigh in on.
• 1:03:33
  So here we go. So I'm going to paraphrase it.
• 1:03:36
  So. Basically joined a company
• 1:03:41
  recently. They're implementing automation
• 1:03:44
  was more of a political issue than a technical one.
• 1:03:47
  And the root of this is basically trust for HR.
• 1:03:52
  It sounds like to me there were issues with data quality from an
• 1:03:57
  HR perspective and so automating it joiners, movers, levers,
• 1:04:03
  right, that kind of thing based off of that suspect data.
• 1:04:07
  People didn't really want to do and he and I think he's he's had
• 1:04:11
  some prior experience of this where you know like an HR feed
• 1:04:13
  failed and you know people got terminated incorrectly, right.
• 1:04:17
  Every once in a while you hear this kind of those horror
• 1:04:19
  stories right around identity management gone wrong.
• 1:04:22
  That's probably a book right there and they put extra text
• 1:04:26
  you know extra checks and stuff like that in there.
• 1:04:28
  And it's actually you know it was on a conversation earlier
• 1:04:31
  today where there was a very similar issue the the HR.
• 1:04:35
  Data quality and I, and probably it's not H R's fault per se, but
• 1:04:39
  the data quality and the authoritative source wasn't good
• 1:04:43
  enough, it was causing problems. So it boils down to do you trust
• 1:04:47
  HR to basically keep their data clean?
• 1:04:52
  Because if you're going to automate, you need cleaning to
• 1:04:54
  start with, otherwise you get automated garbage at the end.
• 1:04:57
  And so I thought it was kind of an interesting topic to kind of
• 1:04:59
  say, well, you know, how does an IT team.
• 1:05:03
  And I am person whoever's in here go off and say, okay, well,
• 1:05:06
  we know a suspect data is coming out of HR.
• 1:05:09
  How do we address that in a way that doesn't alienate us from
• 1:05:13
  our friends over at HR, You know, diplomatic way.
• 1:05:16
  What are the right thing is because I think a lot of
• 1:05:17
  organizations struggle with this fact of look, this is just what
• 1:05:21
  we've been given and we just got to work with it.
• 1:05:24
  I don't know, man, I don't buy it.
• 1:05:25
  I mean sometimes it's it's you have to keep knocking on the
• 1:05:29
  door and raising the arms like, look, this is a problem.
• 1:05:31
  This is a problem. I'm curious to hear both your
• 1:05:34
  guys's thoughts and Justin, we can start with you as the guest
• 1:05:36
  of honor. You know, this concept of
• 1:05:39
  trusting HR, trusting X with data quality.
• 1:05:43
  You know, where do you start with a conversation like that?
• 1:05:45
  So imagine you have a river. That river is your water source.
• 1:05:49
  You're depending on this right now because you were told that
• 1:05:51
  this is the water source that you're depending on, and you
• 1:05:56
  pull water from that source and it's polluted.
• 1:06:00
  It might sometimes be more, might sometimes be less, but
• 1:06:03
  there's a problem with it. So then the question that you're
• 1:06:07
  asking is akin to all right, how do I?
• 1:06:10
  How do I deal with that polluted water source?
• 1:06:13
  And the answer is really similar in data streams as it is in
• 1:06:18
  physical streams. You can.
• 1:06:21
  Address pollution at the source. You can filter it as you go out
• 1:06:25
  and sort of clean it up as best you can.
• 1:06:27
  You can augment it or replace it with a separate water source,
• 1:06:32
  right? You can drill a well instead of
• 1:06:34
  pulling from the river and hope that that's, you know, less
• 1:06:37
  polluted. The real answer is to do all of
• 1:06:41
  those you know. If HR is giving you garbage
• 1:06:46
  data, go help HR stop giving you garbage data.
• 1:06:52
  Like if you're on the IT and Identity team like they should
• 1:06:55
  not like that system. If it's not directly in your in
• 1:07:00
  your purview, you should at least have a hand in saying what
• 1:07:05
  goes on with it, what goes into it, what comes out of it, how
• 1:07:08
  you use it, you know and how it's managed.
• 1:07:13
  And so bring that to the table being like you know we need this
• 1:07:19
  to be cleaner. And it will help you if this is
• 1:07:24
  also cleaner. But that's not good enough
• 1:07:28
  really. You cannot expect pristine data
• 1:07:31
  anywhere. So yeah, still have the
• 1:07:35
  filtering on the way out, still augment it with locally
• 1:07:38
  collected attributes or roles or caches or any number of things.
• 1:07:44
  That allow you to deal with this because you know that an
• 1:07:47
  external source is not always going to be 100% reliable, but
• 1:07:53
  you in cases like this you really, I honestly think you
• 1:07:57
  have to try to fight to help make that source as reliable as
• 1:08:02
  possible. So clean up the river, get
• 1:08:05
  better filters and drill a well. Problem solved.
• 1:08:08
  No problem not solved at all. It is an ongoing journey.
• 1:08:11
  No, we got, we got the water. It's perfect.
• 1:08:13
  We're good to go. Yeah, I mean, so you know, with
• 1:08:17
  the question Marcus said that is more of a political issue.
• 1:08:21
  So I don't really know exactly what that means is like if that
• 1:08:25
  HR doesn't care, you know, they're not willing to do things
• 1:08:30
  to address it. They don't have a communication
• 1:08:33
  path. I think if if it's not those
• 1:08:36
  things like. You know, if you can sit down
• 1:08:38
  with the folks and try to address the issues because they
• 1:08:40
  don't know how serious the issues are, but when it you talk
• 1:08:43
  about people being terminated in the incorrect time frame, then
• 1:08:48
  I'd say is definitely something major, right?
• 1:08:51
  Something major is happening like this data is really bad.
• 1:08:54
  Not just people's names are being misspelled or things like
• 1:08:57
  that. I was thinking about some kind
• 1:09:00
  of layer of abstraction, which I've seen a lot of clients do,
• 1:09:04
  where they create some kind of table.
• 1:09:06
  And database where they're precleaning the data prior to
• 1:09:11
  moving it into their identity management system.
• 1:09:14
  So that could potentially be the answer.
• 1:09:16
  But you know the, the political side, I think, I think kind of
• 1:09:20
  to Justin's point, even if you do it a layer of abstraction or
• 1:09:23
  either even if you do say the HR system just can't, can't fit our
• 1:09:29
  needs, maybe the company has 40HR systems, right?
• 1:09:33
  Maybe that's what the problem is.
• 1:09:36
  Maybe some of them are good and some of them are not good and
• 1:09:38
  you just have to like figure out how do we exist in this
• 1:09:44
  environment where the data is a total mess.
• 1:09:47
  But I do think you need to work on all these things, especially
• 1:09:51
  that political angle like if you have a broken down communication
• 1:09:53
  process or somehow like that team just doesn't care about
• 1:09:57
  your needs, that's dysfunctional for the organization and it's
• 1:10:01
  resulting in the organization's suffering so.
• 1:10:04
  You have to do something to fix that and in the meantime try to
• 1:10:08
  do the patchwork and you know, to make sure that you don't have
• 1:10:12
  outages. Because I do think kind of
• 1:10:15
  stepping away from HR data holistically is not the right
• 1:10:18
  solution. But you know, in that 40HR
• 1:10:21
  system scenario, what I've seen is like okay, you might have
• 1:10:24
  this HR system and I don't want to pick on any particular
• 1:10:28
  country, let's say it's like really far from wherever your
• 1:10:31
  home corporate office is. And they just do things so much
• 1:10:34
  differently. They only update the HR system
• 1:10:36
  once a month or it's offloaded to some kind of third party.
• 1:10:40
  They won't give you extracts, things like that.
• 1:10:43
  So you know, it might be that kind of scenario that just can't
• 1:10:49
  easily be fixed. And when it gets fixed is when
• 1:10:51
  the whole company moves over to, you know, work day to pick the
• 1:10:55
  HR system du jour. So yeah, fix your fix your
• 1:11:00
  governance process, relationship process, whatever, and then do a
• 1:11:04
  multitier technical approach. I poked fun a little bit Justin
• 1:11:09
  saying problem solved because I like.
• 1:11:10
  I really liked your answer. It was a great analogy.
• 1:11:13
  I think people will really under will hopefully understand that
• 1:11:15
  it is a layered effect, right. It's it's almost like you're
• 1:11:19
  filtering the filter right? You're going to throw these
• 1:11:21
  different levels of of cleaning. To try and make sure you remove
• 1:11:26
  as many you know defects as possible from the process.
• 1:11:30
  Will it ever be 100%? Maybe not, but 50% is better
• 1:11:34
  than nothing and 75% is better than 50%.
• 1:11:37
  So it is a journey as you go along.
• 1:11:39
  So absolutely weighed in on that.
• 1:11:42
  I mean, how many people are on municipal water in their houses
• 1:11:45
  that is perfectly safe to drink but still use Brita filters or
• 1:11:49
  you know, a refrigerator with a water filter?
• 1:11:51
  I know, I do. And.
• 1:11:54
  You know, I can absolutely drink the water out of the tap here.
• 1:11:57
  It's totally fine. I have no reason to, you know,
• 1:12:02
  be concerned about it. But it's kind of set up so that
• 1:12:06
  it's actually easier to get a cup of, you know, cold water by
• 1:12:10
  going to the refrigerator, which has this extra filter in it.
• 1:12:13
  And maybe it tastes a little different, maybe it doesn't.
• 1:12:16
  I don't know if I would actually pass a blind test on that, but.
• 1:12:21
  You know, at the end of the day, the result is like.
• 1:12:24
  That's what I go to because that's what works.
• 1:12:28
  It feels good, looks good, it tastes good, whatever it may be.
• 1:12:31
  And sometimes that's all it takes, right?
• 1:12:32
  Exactly. Yeah.
• 1:12:34
  You need to navigate your identity systems by taste.
• 1:12:37
  That should be really the biggest take away from today's
• 1:12:40
  episode. So Becky or Enrique, if you guys
• 1:12:44
  are listening, I'd love to see another dimension added to the
• 1:12:49
  the. Identity rankings for you know
• 1:12:53
  mouth feel almost like a fine wine, right?
• 1:12:55
  Like you know what does this would have legs, you know what's
• 1:12:58
  the coloring look like? Is it full bodied when it comes
• 1:13:00
  to identity? System viscous is for draw.
• 1:13:04
  There you go. All right, let's start to wrap
• 1:13:06
  things up. Because this, you remember how
• 1:13:07
  we talked about, wow, there's no way we spent an hour and a half.
• 1:13:09
  Well, we're already at like an hour and 15, so let's wrap
• 1:13:13
  things up. You mentioned musician and I
• 1:13:16
  want to talk about this band called Cyclic.
• 1:13:21
  Tell me about the band cyclic. So first I will caveat to say
• 1:13:25
  that when you're 19 and an idiot, you should not be allowed
• 1:13:29
  to pick your band name and I really should have moved away
• 1:13:32
  from that at some point. But so Cyclic is the name of a
• 1:13:38
  musical project that I started on my own and have been doing
• 1:13:44
  stuff on and off for gosh, almost 20 years now, 1520 years
• 1:13:48
  in one fashion or another. And I I grew up around music.
• 1:13:53
  I've been playing piano since I was like 6 or 7 years old, did
• 1:13:59
  classical lessons for a long time, selftaught on guitar and
• 1:14:05
  you know, synthesizers and all of the the things that I play
• 1:14:08
  now. And I also, you know, I just
• 1:14:10
  come from a really musical family.
• 1:14:12
  You know, my, my grandmother had a, you know, regionally known.
• 1:14:16
  Band that like my dad and uncle played in and and all of all of
• 1:14:20
  that kind of stuff. I always grew up around music
• 1:14:23
  and so I just, you know, kind of just always kept doing that.
• 1:14:28
  And these days I've been really lucky that, you know, to live in
• 1:14:33
  a time where self-publishing, self recording and
• 1:14:36
  self-publishing stuff is within reach of kind of like average
• 1:14:40
  working people, you know, to be able to get decent quality.
• 1:14:46
  Audio out of a system doesn't take a huge investment and I've
• 1:14:52
  got a decent studio set up now, but that's because you know, I'm
• 1:14:57
  I'm approaching my mid 40s. I've collected little bits and
• 1:15:00
  pieces over the years to like, you know, as as I've been able
• 1:15:05
  to, but I mean this whole time, you know, I could a lot of what
• 1:15:09
  I do, I could do it probably not as easily but I could still do
• 1:15:13
  it on. Just a little dinky laptop and a
• 1:15:17
  tiny little USB interface and come out all right.
• 1:15:22
  And so anyway, I've just, I've always been around music, I've
• 1:15:27
  always had it in me, and I enjoy the process of creating and
• 1:15:33
  sculpting from sort of. The textures of the sounds and
• 1:15:39
  sort of the stories that you can tell with the music itself.
• 1:15:44
  A lot of what I write is instrumental.
• 1:15:46
  I do have some non instrumental, you know, some vocal tracks here
• 1:15:49
  and there. Most of what I do is
• 1:15:51
  instrumental and I really like being able to kind of bring
• 1:15:55
  someone on a journey without telling them what that journey
• 1:15:59
  is. You know, I want to show you, I
• 1:16:01
  don't want to necessarily tell you.
• 1:16:03
  And that's that's what I've always really loved about it.
• 1:16:07
  And you know for the last five years or so I've I've let other
• 1:16:12
  things kind of get in the way of of the music side of things.
• 1:16:16
  I've done little bits here and there.
• 1:16:18
  I, you know contributed to a couple of indie film scores,
• 1:16:21
  little little bits here and there.
• 1:16:24
  But I am finally I I've made it a sort of a personal resolution
• 1:16:30
  to actually get back into proper composition and recording and
• 1:16:35
  and actually trying to get something new out.
• 1:16:38
  Maybe this year, I don't know. I'm, I'm not going to commit to
• 1:16:41
  that on on a on an international podcast here.
• 1:16:44
  But you know, one one can hope that I'll be able to do that
• 1:16:49
  because I love doing it and you know, I just, I love the
• 1:16:54
  creative process and I love the creativity that comes with the
• 1:16:58
  constraints of sort of these music systems because not
• 1:17:01
  everything sounds good, not everything sounds pleasing.
• 1:17:03
  So how do you work with that? It always fascinates me because
• 1:17:08
  I love music, but I am not a musician.
• 1:17:11
  I cannot figure out for the life of me how you would even start
• 1:17:15
  to create anything like that. I, you know, I listen to a bunch
• 1:17:20
  of your stuff actually, when we first heard about it, and I
• 1:17:24
  think it's great. I don't think it's really
• 1:17:26
  diverse. I mean, there's two songs that I
• 1:17:28
  kind of want to point out there. There's one called Snow Runner,
• 1:17:31
  and this is my this is my amateur take on it, right?
• 1:17:34
  It's a very fastpaced. And I kind of mentioned before
• 1:17:37
  we hit record here, it's like it reminded me of something that I
• 1:17:40
  would hear playing in the game wipe out, which is like this
• 1:17:43
  futuristic racer on PlayStation from days of old.
• 1:17:46
  And I love it. Like that's that's my jam,
• 1:17:48
  totally. So funny anecdote about that
• 1:17:51
  song. I originally wrote that as an
• 1:17:54
  accompaniment bit to a video game, and that was that we did
• 1:18:01
  in grad school. So we had a point in point in
• 1:18:06
  this little, you know, graduate class video game where somebody
• 1:18:10
  basically gets a speed boost and takes off.
• 1:18:12
  And I'm just like I I want more than just like oh, it goes and
• 1:18:16
  does a thing. And so I, I went home and wrote
• 1:18:19
  the Rift to that and recorded it in like an hour and like sent
• 1:18:22
  the MP3 to my to my teammates. And it was just like just just
• 1:18:27
  played, you know call MP3 dot play when when that event fires.
• 1:18:31
  And and that was. That was the origin of that
• 1:18:34
  song. I eventually went and made it
• 1:18:37
  into a full song, but but that's that's where that originally
• 1:18:40
  came from. Okay.
• 1:18:41
  So I'm not totally crazy because it really did.
• 1:18:44
  It conveys like a sense of speed is the way when I was listening
• 1:18:47
  to it, the other one that I really liked was called
• 1:18:49
  Incognito Shuffle, which I don't know if it could be any more
• 1:18:52
  different than that other one because it's it's it gives me
• 1:18:57
  kind of like this vibe of like a Speakeasy.
• 1:18:59
  It's a lounge. It's kind of like a very cool.
• 1:19:02
  Jazzy type of vibe to it. I thought it was great.
• 1:19:06
  Yeah, like my my music tastes are really pretty diverse.
• 1:19:10
  I'm I'm really all over the map and in the stuff that I write,
• 1:19:13
  you know, there's there's a lot of electronic rock kind of at
• 1:19:16
  the surface. But honestly, I've got a ton of
• 1:19:20
  like, jazz and Blues influence in what I write.
• 1:19:24
  And so sometimes it really, really comes to the forefront,
• 1:19:29
  like an Incognito shuffle. Like deliberately.
• 1:19:33
  Like I'm going to strip out everything except like and just
• 1:19:36
  just do this. Can I actually write that right.
• 1:19:39
  Like that was that was the constraint.
• 1:19:40
  It's like can I do just this style of of song without adding
• 1:19:44
  all the piles of synthesizers and guitars and all of the other
• 1:19:48
  stuff that I usually hide behind.
• 1:19:51
  And other times it's like no bring bring the wall of noise.
• 1:19:54
  Bring everything in do all of this all together and.
• 1:19:59
  But yeah, a lot of the different stuff that I listen to and I've
• 1:20:04
  been exposed to shows up in the stuff that I write.
• 1:20:07
  And you know, that's I I think that that's true with most of my
• 1:20:12
  life. Like, you know, just all of
• 1:20:14
  these different things that I've done as, you know, Jim Jim was
• 1:20:18
  talking about before, all these different things that I've
• 1:20:20
  gotten involved in. Like to me they're all, they're
• 1:20:24
  all just like connected by like that is interesting and I have
• 1:20:27
  an opportunity. But there's a lot of commonality
• 1:20:32
  that does actually thread underneath them.
• 1:20:35
  So I'm going to try and play a song after this show ends.
• 1:20:40
  It's probably going to be a Spotify exclusive because it's
• 1:20:42
  sort of built into that platform.
• 1:20:44
  So if you're not listening on Spotify, you probably won't hear
• 1:20:47
  it. But definitely check it out.
• 1:20:49
  I don't have a link in our show notes right to cyclic.com.
• 1:20:52
  So you can kind of check out more there.
• 1:20:53
  But it's got, I think the one that you recommended is called
• 1:20:56
  Every morning Orange in Blue, Is that right?
• 1:20:59
  Tell me about that one. So if people are checking it
• 1:21:01
  out, they can kind of get the story behind it as they're
• 1:21:03
  listening. So like with a lot of things
• 1:21:06
  that I a lot of music that I write it started off with me
• 1:21:09
  just playing around and coming up with kind of a a feel for a
• 1:21:14
  riff that I that I liked. And I was just like where where
• 1:21:16
  can I go with this You know what kind of sounds can I can I work
• 1:21:19
  with this and the title of this. Like a lot of the titles in my
• 1:21:23
  songs are just kind of like that's what the music is kind of
• 1:21:26
  telling me that this is the story that's here.
• 1:21:29
  Like I don't necessarily go into write something named that.
• 1:21:33
  It's like I start to write something and it's like, oh,
• 1:21:35
  this is, this is what this is named.
• 1:21:39
  But to me the in that particular song, the energy that it kind
• 1:21:45
  of, you know, starts out with and just kind of dives through
• 1:21:49
  the whole, the whole thing. To me it's it's always felt
• 1:21:54
  like, you know, you're getting up at sunrise and you're
• 1:21:57
  training for some, you know, big athletic thing like this is you
• 1:22:00
  getting up and just going. Like whatever you're whatever
• 1:22:04
  you're trying to tackle, whatever you're trying to get
• 1:22:05
  to, you are getting up and going and getting out there in the
• 1:22:09
  world. And you know, sometimes it's
• 1:22:12
  smoother, sometimes it's more chaotic.
• 1:22:14
  But you're you're moving forward, you never stop moving
• 1:22:17
  forward, even when even when it seems like things might be a
• 1:22:21
  little bit slower. So to me that's that's always
• 1:22:24
  been the story of that song. So I'm going to try and play it
• 1:22:28
  afterwards. It might be a region based
• 1:22:30
  thing. I don't know how positive
• 1:22:31
  advanced people need to go check it out after fact, but.
• 1:22:33
  Digital rights are so strange. They are.
• 1:22:36
  And you know, we've made it this far without a copyright strike
• 1:22:38
  or any of that crap. So I'm trying to trying to keep
• 1:22:41
  the streak alive, Jim. You know, an hour and 20 some
• 1:22:46
  minutes already. We did it.
• 1:22:48
  There's our show. That's our show and we started
• 1:22:51
  off, you know, before the show saying we've never hit an hour
• 1:22:54
  and a half. I'll never hit an hour and a
• 1:22:55
  half. Yeah, I'm sure with a little
• 1:22:57
  tweaks, I'll probably get down a couple minutes and stuff like
• 1:22:59
  that. But yeah, I think we've set the
• 1:23:02
  record. Congratulations, Justin, now the
• 1:23:04
  world record holder for longest identity at the Center podcast
• 1:23:07
  episode. Well, at least for now, I'm sure
• 1:23:09
  you guys will will break that wall soon as sooner than you
• 1:23:14
  think. We're gonna go ahead and wrap it
• 1:23:17
  up for that one. I have like a laundry list of
• 1:23:20
  show notes and links. I've got your LinkedIn profile.
• 1:23:24
  Justin got the website for bespoke engineering.
• 1:23:28
  While you were talking about the the why applications fail, I
• 1:23:32
  found a link for that as well. The book link Gnap.
• 1:23:37
  Sorry gnap. I keep saying gnap.
• 1:23:39
  So small anecdote on that. I know we're already pushing the
• 1:23:42
  links of the show, but there was actually a big debate in the
• 1:23:45
  working group about what the official pronunciation of the
• 1:23:48
  working group was. I strongly came down on the side
• 1:23:51
  of there is no official pronunciation.
• 1:23:53
  Because, like, we can't dictate how people are going to read
• 1:23:56
  this text without somebody reading it to them.
• 1:23:58
  So I say nap, I've heard people say G, nap I've heard people say
• 1:24:01
  nap. I've with a soft G I've heard
• 1:24:04
  all sorts of things. I think they all apply.
• 1:24:07
  So yeah, don't. Don't apologize for it being
• 1:24:10
  different. All right.
• 1:24:11
  So I have, I have a grace period there.
• 1:24:13
  What? So I have a link to that.
• 1:24:15
  We'll have a link to cards against identity gridlock,
• 1:24:18
  Boston, obviously cyclic. And then?
• 1:24:23
  You kind of told the story a little bit earlier during the
• 1:24:25
  conversation, but the precious cinnamon roll and so The Onion
• 1:24:29
  article that that's sort of like based on as well.
• 1:24:32
  So chock full of links. Yeah.
• 1:24:34
  So that's that's for people to look at.
• 1:24:37
  Yeah, we're going to leave it there.
• 1:24:38
  You know, we're on the web, idacpodcast.com.
• 1:24:41
  We're on Twitter at IDAC podcast, we're on Mastodon at
• 1:24:46
  IDAC podcast at infosec dot exchange.
• 1:24:50
  No, we're not on threads yet. I don't know if you ever will
• 1:24:52
  be. Most of our engagement comes on
• 1:24:54
  LinkedIn and Twitter and that's probably what we'll stick for
• 1:24:56
  now. But definitely you can always
• 1:24:57
  connect with Jim and I on LinkedIn.
• 1:25:00
  If you've got questions, send them in right.
• 1:25:02
  This is our opportunity where we can get smart people, you know,
• 1:25:05
  on the line with us and get some real expert opinions of some of
• 1:25:09
  those stuff. So hopefully people enjoy that
• 1:25:11
  as well. And don't forget about
• 1:25:12
  authenticate. So use our conference code it
• 1:25:15
  is. If I could find it here I DAC.
• 1:25:18
  15 podcast, 15% off. Hopefully we'll see a lot of
• 1:25:22
  friendly faces there. Hopefully you'll help us figure
• 1:25:25
  out what that live show looks like, Jim, when we when we get
• 1:25:28
  up on the stage as we kind of go along.
• 1:25:30
  But yeah. So Justin, thank you so much for
• 1:25:33
  your time. Jim, thanks for your time and
• 1:25:36
  we'll go ahead and leave it there.
• 1:25:37
  Thanks for listening. We'll talk with everyone in the
• 1:25:39
  next one. You've been listening to
• 1:25:41
  Identity at the Center. We hope you've enjoyed the show.
• 1:25:46
  Make sure to like, rate and review and we'll be back soon.
• 1:25:50
  But in the meantime, hit the website at
• 1:25:52
  identity@thecenter.com and find us on Twitter at IDAC Podcast.
• 1:26:00
  See you next time on Identity at the Center.