Latest / North Meets South Web Podcast / Unused APIs, Passport testing traps, and local AI bottlenecks

Transcript

Unused APIs, Passport testing traps, and local AI bottlenecks · North Meets South Web Podcast

• 0:00
  Hey, I'm Michael Dyrynda.
• 0:01
  And I'm Jake Bennett
• 0:03
  And welcome to episode 192 of the North Meet South web podcast.
• 0:10
  All right, Michael, last time we were on the air, I spent most of the time talking,
• 0:16
  and so it is now your turn to bring to the table
• 0:20
  all the amazing goodness that you are working on or all the problems that you
• 0:23
  have. And if we have time
• 0:26
  at the end, maybe I could throw something in there.
• 0:29
  But today is your show, my friend.
• 0:31
  Well, actually, you know what? It wasn't actually me. Well, I suppose it was me
• 0:33
  sort of talking a lot of the time. It was David Hemphill was on, right?
• 0:36
  -Right. -Time before that, though, it was almost
• 0:38
  all me talking. So anyway.
• 0:40
  Yeah, how are things going for you, dude? What, what's, what's going on with work
• 0:43
  at, at your place?
• 0:44
  It's good. Um, work's, work's been busy doing, doing lots of, uh, different
• 0:50
  things, um,
• 0:53
  just
• 0:54
  building new APIs 'cause we, we, we purged, we, we destroyed, we deleted-
• 0:58
  -Ah -... off the face of the earth, the old
• 1:00
  -Jason API a few months ago. -Really?
• 1:02
  -And now- -Okay. What's the reason for that?
• 1:04
  -Yeah, well- -What, what was... Is this-
• 1:06
  -I mean, the main- -... the internal API that all of you guys
• 1:08
  use?
• 1:09
  -Yes. Yeah. -Okay.
• 1:10
  I mean, when, when it was built, the idea was that everything would be exposed over
• 1:15
  a public API that we would be the primary consumer of with our front end, with our,
• 1:21
  um,
• 1:22
  -Vue SPA on the front end. But then- -Right
• 1:24
  ... we would have people that would consume that API for-
• 1:28
  -Ah -... their own purposes as well.
• 1:29
  -Okay. Did you- -But because of the-
• 1:31
  ... advertise this? Was it made-- Was-- Did you have, like, public documentation,
• 1:34
  or was it just people figured it out and were like-
• 1:34
  Yeah, there was public documentation for it. Yeah, yeah, we had docs for it, but
• 1:38
  the, the kinds of customers that we had were not really of a size or scale
• 1:43
  bec-because they're, they're brokers, right? Asset finance brokers or mortgage
• 1:46
  brokers. They're not really
• 1:49
  companies that have
• 1:51
  -in-house dev teams and people that are- -Not gonna be technical
• 1:53
  -... gonna be building these integrations- -Yeah
• 1:54
  ... and things like that. And so
• 1:56
  there was opportunity to use things like Zapier to, to push from, like, their CRMs
• 2:01
  via Z-Zapier into our APIs and things like that, but it just never really
• 2:05
  eventuated. And as we started to rebuild our platform,
• 2:09
  it became more and more clear that the benefit of using our platform was not
• 2:16
  in the API that
• 2:18
  -was never used anyway. It was more from- -Yeah
• 2:21
  ... the logic and the business rules and everything that tied it all together. You
• 2:24
  know, you could create a person resource or a business resource or a, you know,
• 2:29
  whatever,
• 2:31
  but it was the rules around what that meant and how they came together and, and
• 2:37
  the, you know, the roles that you would assign to people and their relation to the
• 2:41
  application that are attached to and things like that. And that,
• 2:44
  that core business logic lived in our application. It lived in the front end. It
• 2:49
  was, you know, it was not...
• 2:51
  And so
• 2:52
  over time, you know, I said three years ago, four years ago, "We don't need this
• 2:56
  API. No. Like, who, who is the, the audience for this?" And it was, you know-
• 3:00
  -Yeah -... it was always a case of, like, someone
• 3:01
  build it, and they will come, and, and that never eventuated. But-
• 3:05
  Yeah
• 3:07
  ... we, we got rid of that a few months ago now, and it's, and it's gotten to the
• 3:11
  point where, okay, now we can look at what we do actually need to expose. And as
• 3:15
  we've grown over the last few years, and, and we're, we're working with,
• 3:20
  um, larger businesses, and they've got more capability on their side to
• 3:24
  integrate, what, what do we actually need to provide them, and where do we draw the
• 3:27
  line around, you know,
• 3:29
  they're just sending us lead data, and then they're coming in, and they're using
• 3:33
  our platform to fill that in. They're building out,
• 3:35
  um, you know,
• 3:37
  org chart is probably the most simplistic way of doing it, but it's like, uh,
• 3:41
  company structures. So, you know, a company that has, uh, a director, that has
• 3:45
  shareholders, whatever, you know, all this stuff that we can kind of map out.
• 3:49
  And so, you know, use the platform to, to do that kind of stuff rather than,
• 3:55
  um,
• 3:57
  APIs. So we've kind of now with the experience of knowing who those consumers
• 4:02
  are and what they actually want to do and be able to do, we can now build that kind
• 4:06
  of functionality out. So that's, that's where we are now in terms of,
• 4:11
  um, you know, building, building all that functionality out.
• 4:14
  So that's, that's what I've been working on, um, you know, using Passport and, and
• 4:19
  doing some, like,
• 4:21
  some interesting things, I think, that are kind of just the way that
• 4:25
  our
• 4:27
  users, um, need to be able to,
• 4:30
  to interact with the platform. So we don't really have the notion of a,
• 4:36
  a request user. Like, a user is not making a request. It is a-
• 4:39
  -Okay -... it is a Passport client that is making
• 4:42
  a request, and that client has access to one or more groups, and then it has access
• 4:48
  to one or more users in each of those groups. So it's kind of like the client is
• 4:53
  then granted
• 4:54
  access to one or more groups,
• 4:58
  -and groups like just group- -Do you have a model for client?
• 5:00
  ...
• 5:01
  like businesses. We've got a-- Yeah, it's just the Passport model. And then so we've
• 5:04
  -introduced another one- -What-
• 5:05
  -... that is like a pivot- -Yeah
• 5:07
  -... table that says, like, this client- -Wait, wait. Sorry
• 5:09
  -... has access to- -So, like, client, client is the Passport
• 5:12
  model, or client is just a model that represents, like, what, who is the client
• 5:16
  -in your domain? Like, g- in the plan- -Uh, so yeah, Passport-
• 5:18
  -... who's the client? -It's a Passport client. Yeah.
• 5:21
  Oh, it's just like Passport client is the name of it?
• 5:22
  The term-- Yeah. So we're talking about, like, we go-
• 5:24
  -Gotcha. So you just- -... we go and create a Passport client.
• 5:26
  Yeah. And then that Passport client just has, like, um,
• 5:29
  tokens?
• 5:30
  -Like it has- -Yep
• 5:31
  ... personal access tokens? Because Passport-
• 5:32
  -Yeah, so it's got a client ID- -That's kind of how it works
• 5:33
  ... and secret. Yeah. So Passport manages-
• 5:35
  -Yep -... all of that side of things.
• 5:37
  Um, we don't,
• 5:39
  we don't allow our customers to create their own clients. We will create them for
• 5:43
  them, and then we'll give them the ID and secret, you know, the credentials. And
• 5:46
  then we will link up, okay, this Passport client belongs to this group of users. And
• 5:52
  so you have access to one or more groups,
• 5:56
  and then you will have access to all of the users and all of the resources within
• 6:00
  -those groups kind of thing.And so- -Can you, um... I, I don't wanna interrupt
• 6:05
  with that, but I, I am curious if we could loop back to it at some point. Passport
• 6:09
  -versus Sanctum. Like, if there was an in- -Mm-hmm
• 6:11
  ... if the, you guys had discussions around that, or
• 6:14
  any interesting, like, caveats or trade-offs between those two solutions.
• 6:20
  -Um- -Um,
• 6:21
  mostly just because Passport was already
• 6:24
  in the platform, like, we were already using it for things.
• 6:27
  Um,
• 6:28
  I think we are using Sanctum for our first party functionality.
• 6:32
  Ah. Yeah, that would make sense.
• 6:34
  Yeah. So all of our first party SPA is built,
• 6:39
  um, built on top of Sanctum.
• 6:42
  Uh, but all of, all of the API stuff is Passport, which I think is,
• 6:47
  I think that is the delineation. That Passport is-
• 6:50
  -Okay -... for more external stuff and Sanctum is
• 6:53
  more for your first party applications. I mean-
• 6:55
  -Interesting -... I could be wrong
• 6:56
  -I wouldn't- -But that's-
• 6:56
  I didn't know that that was the delineation. Yeah, I mean, it's, I think
• 6:59
  there is, like, a Passport or Sanctum. "Before we get started, we wish to
• 7:02
  determine if you would be better served by Passport or Sanctum.
• 7:05
  If your application absolutely needs to support OAuth 2, you should use Laravel
• 7:08
  Passport. However, if you're attempting to authenticate a single page app, mobile
• 7:12
  application, or issue API tokens, you should use Laravel Sanctum."
• 7:16
  -Hmm. -Laravel Sanctum-
• 7:17
  -And I think we've got like this- -... does support OAuth 2, but it's a much
• 7:19
  simpler API authentication development experience.
• 7:21
  -Mm-hmm. -Which has been my experience. Yeah, like
• 7:23
  OAuth 2 is just,
• 7:25
  I don't know, there's a lot of stuff that integrates it with it now, like, you know,
• 7:28
  to the point you're making, like,
• 7:30
  you know, Zapier, all, all those things. They, they have full OAuth 2 support, so
• 7:33
  it's not, it's not like a big lift on their side, you know what I mean?
• 7:36
  -Yeah. -It's probably very familiar to some of
• 7:38
  those things. Whereas, like Sanctum, it's just like you have to go and you have to
• 7:40
  issue an API token and all that good stuff. So-
• 7:43
  -Mm-hmm -... um, yeah, I hate it, I hate OAuth 2. I
• 7:46
  -mean, I, that's a little bit- -Yeah
• 7:47
  ... of a strong language, right, sort of thing. I just, it's, it's always been a
• 7:49
  pain in the neck for me when I have to set up a new application that has to
• 7:52
  -authenticate with OAuth 2 versus- -Mm-hmm
• 7:55
  ... uh, using Sanctum. 'Cause Sanctum, you just grab, you, you grab an, a single API
• 7:58
  token,
• 7:59
  and it's good. For forever, right? For as long as you need it.
• 8:02
  -Right. Yep, yep. -Whereas with OAuth 2, it's like it
• 8:04
  expires, you have to issue a refresh token, and then the refresh token-
• 8:07
  -Right -... has to be used to fetch a new token,
• 8:08
  and then you get a new re- refresh token, all that stuff. Um-
• 8:11
  -Mm-hmm -... yeah, so, eh, I don't know. I don't
• 8:14
  know.
• 8:15
  Yeah.
• 8:16
  So, yeah, because, because the client will have access to resources
• 8:21
  based on, on that pivot table,
• 8:24
  um,
• 8:25
  it means that
• 8:26
  we don't have, like, the authenticated user is not being as attached to these
• 8:30
  -things. The authenticated user has- -Yeah, that makes sense
• 8:31
  -... access to groups and users. -Mm-hmm.
• 8:34
  And so we, we require that you pass these via headers. So you pass the group ID as a
• 8:38
  header, you would pass the user ID as a header, and then as part of the, the
• 8:43
  request authorization, we go and check, "Hey, do you have these fields? Does this
• 8:47
  request require both a group and a user, or, or is it a group only thing?" Um,
• 8:54
  and then based on the request, which we, which we set on the request, the form
• 8:59
  request object, which we use for all of our validation authorization stuff,
• 9:03
  it will then figure out, "Do I need one or both?"
• 9:06
  It will then go and look up that user, and it will set that as the, as the user on
• 9:11
  the, on the API guard,
• 9:13
  -so that- -Mm-hmm, mm-hmm
• 9:14
  ... you know, we can use request user throughout the process-
• 9:16
  -Yeah -... and things like that.
• 9:18
  Um,
• 9:20
  interesting side bit to that, we, we have this macro
• 9:24
  defined on the request class called authenticated user,
• 9:28
  and that mostly exists to satisfy Stan, like static analysis.
• 9:32
  -Mm-hmm, mm-hmm. -Because
• 9:34
  the,
• 9:35
  um,
• 9:37
  the request user will, doesn't actually return a user, it returns an,
• 9:42
  an implementation of authenticatable, but it can also return-
• 9:46
  -Yeah -... null.
• 9:47
  And so you, you find yourself, you know, depending on what level of LaraStan,
• 9:50
  PHPStan you're using, you've gotta go and, you know, assign a variable, and then
• 9:53
  attach a doc block.
• 9:55
  -You know, a comment to it that says- -Which is lots of operators everywhere
• 9:58
  -downstream -... that, like, this is a user. Yeah.
• 9:59
  -Yeah. -Yep. So we've just created a, a request
• 10:00
  macro that basically the request macro says authenticated, the, the method
• 10:05
  authenticated user will always
• 10:08
  return a user.
• 10:10
  -'Cause we know that by- -Yeah
• 10:11
  ... the time we get to that point, we've already gone through the request, the, the
• 10:14
  auth middleware that says y- there's a user here, so we know that it's going to
• 10:18
  exist. We don't have to do those null checks everywhere and things like that.
• 10:21
  -Nice. -And whatever else. So,
• 10:23
  um, that's been very handy. I did, did run into an issue today, actually, where
• 10:26
  we're using that authenticated user. And I, I've actually... Let's,
• 10:31
  don't worry about all of this work stuff. This is boring, um, in the context of, uh,
• 10:35
  Laravel, and, and for our listeners, I think it's probably more useful to talk
• 10:38
  about, like, some of the interesting things that I've run into very recently,
• 10:42
  actually,
• 10:43
  is the way that Passport handles
• 10:46
  authentication and how it kind of fakes all of this stuff in CI-
• 10:50
  -Hmm -... or in your test environment.
• 10:52
  -Okay. -So when you use, like, Passport acting as,
• 10:54
  or Passport acting as client, it does some munging of the-
• 10:58
  -Which- -... request life cycle, which can bite
• 11:01
  you.
• 11:02
  Yeah, can I, can I quick inter- interrupt? So, like, when you're talking about that,
• 11:05
  you're saying, like, in your testing, in your CI,
• 11:08
  where you do Passport acting as, which is basically just a nice little helper
• 11:11
  function to say, like, "Okay, in the case that you authenticated using Passport as
• 11:16
  this user," like, assume that's the case, now start this request. And you can do the
• 11:19
  same with Sanctum, but there's just little helpers that are available for
• 11:22
  Passport, whatever. And so you're saying
• 11:24
  that's all doing fake stuff behind the scenes.
• 11:27
  Right. Yeah. And it, and it, and it's not just, like, setting a user. It's going
• 11:31
  and, and scaffolding a whole bunch of stuff out. So if you say,
• 11:35
  um, that this route is being accessed by this client, so, like, this OAuth client,
• 11:40
  it'll go and set some things up there. If you say it's using this user, it'll go and
• 11:43
  set a user on the guard. Um, if you say that, that this route requires specific
• 11:49
  scopes, like if you need a user's colon read-
• 11:52
  -Yeah, right -... or users.read or whatever, it will go-
• 11:54
  -Mm-hmm -... and it will set the, the, um, the
• 11:57
  Passport resource server to have those things already in there. So we've run into
• 12:03
  issues in the past where I have forgottenTo,
• 12:07
  to register the passport token. So there's in a service provider-
• 12:11
  -Mm-hmm -... you put like passport.tokens can, and
• 12:14
  then you pass it array, an array of tokens.
• 12:18
  Now, I've forgotten to do that in the past,
• 12:20
  saying that, you know, "Here's a user's .read token." So all of your tests are
• 12:25
  passing, you, you put tests in there to make sure that like, "Hey, if I don't pass
• 12:28
  this scope that this will fail. If I do pass the scope, it will let me through,"
• 12:31
  -and all of that. -Right. Sure.
• 12:32
  All the tests are there and it's working. You get to production because you haven't
• 12:34
  actually registered the token.
• 12:37
  Um, the, uh,
• 12:38
  best I can tell, and I'm not saying this with 100% certainty because I haven't,
• 12:43
  haven't looked into it too closely as yet, but the best I can tell, the only place
• 12:47
  that it checks that you've got a valid scope is on the, the token endpoint where
• 12:53
  you are actually requesting a token for a scope.
• 12:56
  So if I was to,
• 12:58
  and this is where we end up running into it, is when the consumer of the API then
• 13:02
  goes to, you know,
• 13:04
  myapi.com/oauth/token,
• 13:07
  says, "I want a, a client credentials grant type. Here's my client ID, here's my
• 13:11
  secret, and I want this user's .read scope."
• 13:14
  If I have not put that user's .read scope into the tokens can,
• 13:19
  um,
• 13:22
  method
• 13:23
  -in the service provider somewhere- -Okay. Yeah
• 13:24
  ... it will come back with an error saying that this is an invalid scope, you know,
• 13:28
  and you can't do it.
• 13:30
  -Mm. -Um, but n- none of that happens in, in
• 13:32
  your test because you're not, you're not doing that process. Um,
• 13:36
  -so we've now gone and dynamically- -Interesting
• 13:38
  ... registered all of these scopes, right?
• 13:39
  -Yeah. -So we've put all of the scopes inside of
• 13:41
  an enum.
• 13:43
  -And so- -So, yes, exactly. Because-
• 13:45
  Now we just do like, in inside that method we just do like dot, dot, dot
• 13:49
  scopes, colon, colon, cases,
• 13:52
  and then we just loop through it. You know? For each of these, we'll map it and
• 13:55
  we'll return all of those values. So here's the, the value, and here's the
• 13:58
  description from that enum, and that we, we don't have to worry about it anymore,
• 14:02
  -a- about forgetting- -Right
• 14:02
  ... to do that. 'Cause,
• 14:04
  you know, I went and wrote a test, and as I was writing this test that then returned
• 14:07
  all of the enums to make sure that we registered, I was like, "Well, actually, I
• 14:10
  don't need to write a test for this behavior.
• 14:13
  I can just use this same loop that I've written that,
• 14:18
  you know, is testing that the enums have been registered to just-
• 14:21
  -And just register them -... register them."
• 14:22
  -Yeah. -Yeah.
• 14:23
  -Yeah, exactly. -And, and so like the only, like they all
• 14:25
  need to be registered. If they're in that scope enum, it's because we need them for,
• 14:29
  you know, functionality, and so we put that in there. So
• 14:33
  just a little, little gotcha that I've run into a couple of times now and I thought,
• 14:37
  "Well, we're gonna go and fix this in such a way that I don't run into it," and
• 14:40
  then, you know, you don't for... 'Cause how often are you adding scopes? You know,
• 14:43
  you come back in six months and you go, "Okay, I added it to the docs and I added
• 14:46
  -it here- -Yep. Yeah
• 14:46
  ... and I wrote the test for it, and we're all good and we're in production," and
• 14:48
  then someone's like, "Well, I, it's not giving me the scope." And it's like, "Oh,
• 14:51
  yeah. I see." So.
• 14:54
  Yep. Yep. We had a similar situation with our permissions. So,
• 14:59
  um,
• 15:00
  yeah, we started using enums and using cases, and it is just the best because-
• 15:05
  -Mm -... you had it in one spot and it just
• 15:07
  works everywhere.
• 15:08
  And so, yeah, that is a clutch move. I'm loving, loving those enums. That's, that's
• 15:13
  pretty great.
• 15:15
  -Pretty great. -So just-
• 15:16
  -That is interesting though -... yeah, there's like
• 15:17
  That all your tests would pass and everything, and then nope, production
• 15:20
  -fails. That's, that sucks. -Think you're doing the right thing. But
• 15:21
  -yeah. -Yeah.
• 15:22
  Acting as, like acting as will create a new act, uh, access token, and it will-
• 15:27
  -Mm-hmm -... set the OAuth client ID, it'll set the
• 15:29
  user ID, it'll set the scopes. It'll attach the access token to the user,
• 15:35
  um, and then it will go and set the user on the auth guard. It will set, um, and
• 15:40
  then it runs like auth should use on the guard-
• 15:42
  -Mm-hmm -... and it kind of just like munges all of
• 15:44
  that together.
• 15:45
  -Yep, yep. -So it's like
• 15:47
  it's circumventing a bunch of stuff that you would actually do in, in production
• 15:50
  where you would, where you would go and get a token and you would go through this
• 15:53
  registration process and things like that.
• 15:55
  Um, acting as client will mock a resource server, and it will go and, you know, set
• 15:59
  the scopes and the user ID and the client ID and all of this kind of stuff. So,
• 16:03
  um, yeah. We, and we ran into some like other weird issues where if you're using a
• 16:08
  client,
• 16:10
  OAuth client that is, that doesn't have a user attached to it, there's some like
• 16:15
  stuff happening behind the scenes in Passport that will take the client ID and
• 16:18
  attach it to the user ID,
• 16:20
  and then it will go and try and find that user using the like database provider
• 16:26
  from the database.
• 16:27
  Um,
• 16:29
  and, and in our staging environment, we've still got some like old data in there
• 16:34
  where we haven't, we haven't changed all of the IDs over to Snowflakes. So when
• 16:38
  we've got like client ID of five in the OAuth clients table, it then goes, "Oh,
• 16:43
  there's no user attached to this, so we'll set that to the user ID as well."
• 16:47
  -Oh, yes. -Then it goes and tries to find the user.
• 16:49
  -Ooh, boy. -And it does, you know, selects out from
• 16:51
  users where ID equals five, and then it returns a completely different user, and
• 16:55
  things start to go wonky because that user doesn't have access to the... I'm like,
• 16:59
  -"Well- -Yeah, that's interesting
• 17:00
  -... this seems a bit..." -Yeah.
• 17:01
  Yeah, so we went, we went to fix that up yesterday, but it's just like...
• 17:05
  And I,
• 17:06
  I had a, a rough idea of like how to fix it, but I sent Claude after it, and it was
• 17:10
  -just watching- -Yes
• 17:11
  ... Claude well actually itself going in loops, going, "I could do this, and the
• 17:14
  easiest fix would be this." And then he goes, "But hang on," something, and it's
• 17:17
  just like, okay, well, we- we'll-
• 17:20
  Any time that you have to dive into Passport, uh, it gets a bit... Like
• 17:25
  Passport abstracts a lot of stuff away, but any time you have to go diving through
• 17:28
  there to figure something out, it gets a bit grim. It gets even worse when you have
• 17:31
  to start diving into like the League OAuth package, and then you can write the
• 17:35
  -whole day off at that point. -Yeah. I need to look into League OAuth,
• 17:39
  um, as like, uh, not as the server side of it, but as like the consumer side of it.
• 17:44
  'Cause like I said, when we have to integrate with an OAuth endpoint, uh, it's
• 17:48
  sort of painful, and I know there's solutions out there. I just, it was like-
• 17:51
  -Mm -... one of those things where it's like,
• 17:52
  "Oh, I can do this in like a half, like an hour and a half or whatever. No big deal.
• 17:56
  I can just kind of like do this myself," and you do it, and then,
• 17:59
  um, you know, it freaks out.
• 18:02
  Uh, but yeah. Anyway, I need to look at that, uh, that League OAuth 2 stuff
• 18:06
  because I think there's probably a better way to do that than the way that I'm doing
• 18:09
  it, which is like some home-rolled sort of, sort of deal.
• 18:12
  So anyway.Hey, um, you wanna talk about, uh, adversary in the middle attacks real
• 18:18
  quick?
• 18:20
  Yeah. I saw you put that in there. Tell us, tell us about it.
• 18:22
  Have you ever heard of this?
• 18:25
  -No. -Okay.
• 18:27
  There was a breach by a company, or of a company called Striker,
• 18:32
  -um, maybe a month ago. -Mm-hmm. Mm-hmm.
• 18:34
  And it was one of the largest
• 18:37
  cyber attacks, like, in recent history. They wiped 200,000 devices in,
• 18:44
  like, 79 countries in four hours.
• 18:48
  And so the way that that worked is they stole credentials from an administrator,
• 18:53
  and they went into Microsoft Intune, which is like a, uh, MDM sort of endpoint
• 18:59
  manager,
• 19:00
  and they just issued a wipe all command to every single enrolled device.
• 19:05
  -Phones, computers- -Wow.
• 19:07
  -Everything. -Really?
• 19:08
  Just wiped them all. And it wasn't malware or anything. It was like, it was designed
• 19:11
  to do that. They just had the credentials to do it. And they had no sort of, like,
• 19:16
  um, it's called MAA, multi-administrator approval, similar to like a pull requests,
• 19:21
  -right? How you can't- -Yeah
• 19:22
  ... merge a pull request without another person taking a look at it.
• 19:25
  -Right. -They didn't have that turned on,
• 19:27
  and so we have that turned on everywhere now, multi-administrator approval. But the
• 19:31
  way that the leading theory as to how they stole the token is called adversary
• 19:36
  in the middle attack. So this is really interesting. Um,
• 19:40
  I feel like up until this point, we've always touted MFA as like, well, it
• 19:43
  doesn't matter if somebody gets a link in an email and gets phished because they
• 19:47
  have MFA, and they can't defeat their MFA. No big deal, right?
• 19:50
  -Mm-hmm. Mm-hmm. -Well,
• 19:52
  -this can. -Now it's actually can.
• 19:54
  And so,
• 19:55
  yeah, this can. And so the way that it works is they send you to a link that is a
• 20:01
  fake link,
• 20:02
  but they act as a reverse proxy,
• 20:07
  and they will send you to your real tenant's
• 20:11
  single sign-on login page.
• 20:13
  And so,
• 20:15
  um,
• 20:16
  it's proxied though, right? But so what it'll do is it'll ask, "Hey, what's your
• 20:19
  username?" You put it in. They proxy it forward. "What's your password?" They
• 20:22
  proxy it forward. "What's your 2FA?" They proxy it through, or you get a
• 20:26
  notification on your phone, and then you type it in. And they steal your token
• 20:30
  that you're getting back, and then they forward it back through to you so that you
• 20:33
  never even know that anything happened, right? Everything looks completely legit.
• 20:37
  It looks totally fine,
• 20:39
  but they now have the token.
• 20:41
  And so
• 20:42
  the only way to defeat this is using strong MFA, like a hardware token or
• 20:49
  passkeys,
• 20:51
  which until recently I've been like, "Screw passkeys. I'm never using a
• 20:53
  passkey. They're so annoying." They're actually not that annoying, actually, if
• 20:56
  you have,
• 20:57
  uh, like 1Password. They're pretty convenient.
• 20:59
  -Mm-hmm. Yeah, yeah. -Pretty convenient.
• 21:00
  They integrate with 1Password.
• 21:01
  Super nice. Super nice. But that's the only way to kind of defeat these things is
• 21:06
  to use a passkey.
• 21:09
  Otherwise, 2FA, it just kind of goes right around it, no big deal. So, you know, if
• 21:14
  you're... You know, obviously you have to be compromised in the first place by
• 21:17
  clicking on a link that is not a correct link.
• 21:20
  -Mm-hmm. -But after that, everything looks
• 21:23
  completely legit. And so it's kind of scary because we're now having to say
• 21:28
  like, "Okay,
• 21:29
  MFA alone is not sufficient, especially for our people who are at the top level of
• 21:34
  our organization as far as the technical side of things is concerned." And so we've
• 21:38
  had to sort of enforce passkeys everywhere, which has been a bit of a
• 21:41
  thing. Um, but it feels like, man, it feels like these attacks are coming
• 21:48
  quicker and quicker, more and more frequently. Seems like every time-
• 21:50
  -Yeah -... we're talking, we're talking about
• 21:51
  another one. I don't know if you knew Canonical, like Landscape-
• 21:54
  -Oh, yeah, um- -... Ubuntu, Landscape, Canonical.
• 21:56
  -Ubuntu, yeah. -Canonical, they've been under a D- a DDoS
• 21:58
  -attack since like- -Yeah
• 21:59
  -... uh, like s- Friday, last Friday. -Yeah. I, I thought it was very nice-
• 22:03
  -Um- -... of those attackers to say that like,
• 22:04
  "This is gonna continue for four hours."
• 22:07
  -Like- -Yeah.
• 22:07
  -... "Oh, okay. I guess- -Yeah
• 22:09
  ... in four hours we'll be okay. Sorry, guys." You know?
• 22:11
  Yeah. Right. Right. And then they're like, "Oh, no, just kidding. Four days later,
• 22:15
  it's still kind of going on."
• 22:17
  -Mm-hmm. -Um, but yeah, it's kind of crazy, man. It
• 22:19
  is just a Wild West out there right now, it feels like. Um,
• 22:23
  and then there's that, that CVE that came out, that copy run something something
• 22:26
  whatever. I don't know if you got that notification in Forge
• 22:29
  -that was like- -Oh, uh, yeah, yeah, yeah
• 22:31
  -... "Hey, by the way- -Recent service
• 22:32
  ... there's like this CVE thing that you need to take a look at." Yeah. So man, it
• 22:36
  just feels like... I, I feel like half of my time in the last month has been spent
• 22:40
  chasing down things that are like, "Oh, don't,
• 22:43
  don't miss this thing. Make sure you're taking care of this. Make sure you don't
• 22:46
  miss out on-"
• 22:47
  -Yeah -... you know, this whatever. And so, um,
• 22:50
  anyway, I don't know. It's, it's interesting. I feel like
• 22:54
  maybe this will be the thing that'll get us to adopt passkeys, uh, by like-
• 22:58
  -Mm-hmm -... you know, largely. Um,
• 23:01
  and so anyway, it's, it's been good to use passkeys and kind of get familiar with
• 23:06
  it.
• 23:07
  Um, but n- now it's making me wonder too, like, okay, which of my apps should I
• 23:10
  implement passkeys in, and
• 23:13
  is that a thing I really need to do? And so I don't know. It'll be, it'll be
• 23:16
  interesting. It's gonna be a whole new requirement now, like on all these
• 23:19
  security things that we get from our clients. Like, you do 2FA, but do you do
• 23:22
  passkeys? You know?
• 23:24
  And so that might be something we need to start looking into. I feel like Matt
• 23:27
  Stauffer did like a deep dive on passkeys not too long ago, didn't he?
• 23:31
  Uh, yeah. I remember seeing it around somewhere. Um, I mean, it's... 'Cause
• 23:35
  it's, it's built into the, the Laravel starter kits now as well as a, as an auth
• 23:40
  option, so.
• 23:41
  -Nice. -Must be part of, uh,
• 23:46
  -Fortify. -Fortify?
• 23:46
  -Mm. -Yeah.
• 23:49
  So anyway, I gotta look into that a little bit. Now, thankfully for us, like our
• 23:53
  authentication stuff is all built in through SSO, uh, with our tenant, with our
• 23:57
  Microsoft tenant client. So,
• 23:59
  um,
• 24:00
  we don't really have to worry about that. We can just enable it in there, and it's
• 24:02
  -all set to go. But- -Mm-hmm
• 24:04
  ... for things that we do that are public-facing, those, that'll be something
• 24:07
  we'll have to take a look at, so.
• 24:10
  It's a crazy world out there, man. It is a crazy world.
• 24:13
  -It certainly- -Yep
• 24:13
  ... I mean, it's getting there more and more now simply because,
• 24:17
  like y- you would have to say that it's because ofThe availability and the
• 24:22
  prevalence of AI now.
• 24:24
  -Agreed. -That you can just-
• 24:25
  -Yeah, agreed -... send the AI off to, to do your bidding
• 24:27
  now, where,
• 24:29
  you know, before there was obviously
• 24:31
  people that were very skilled
• 24:33
  and, you know, state-backed organizations and whatever else that are in positions to
• 24:37
  go around hacking things. But, but now,
• 24:40
  you know, you just set Claude off, and off it goes and figures out, "Okay, I'm gonna
• 24:45
  go and bust into this thing or that thing or, or whatever else," and-
• 24:50
  -Exactly -... you just let it spin until it finds
• 24:52
  something.
• 24:53
  And, and it's just gonna happen more and more often
• 24:57
  and, and
• 24:58
  faster and faster just because it's, it's possible now, so.
• 25:02
  Yeah. Like, I don't know if you saw that... And, and people can use like, you
• 25:06
  know, their own local models and stuff. I, I sent a chat this morning, um, that we
• 25:10
  have a couple local models, whatever, and the token throughput was 140 million
• 25:16
  tokens.
• 25:18
  -Oh, this is on your- -And-
• 25:19
  -... on your G- -Yeah
• 25:19
  -... GTX, RTX thing? -Yeah. DGX. Yep. And we've got, like, four
• 25:23
  of them now.
• 25:24
  Um, so these things, we're creating a little farm over here. It's been really
• 25:28
  cool. Um, and so we should have Andy on to talk about this. Maybe he'll talk about
• 25:32
  it in his podcast a little bit, but it's been really interesting to ke- see some of
• 25:35
  the stuff that they're working with and working on. They're using the Gemma 4
• 25:39
  -model now. -Mm-hmm.
• 25:40
  -And it's been, uh- -Yeah
• 25:41
  ... pretty, pretty awesome. Yeah, it's been really, really good. And so they've
• 25:45
  got that on all the DGXs, and they're sort of running a load balancer in front of
• 25:48
  -them, and it's, it's been really- -Mm
• 25:50
  ... really interesting to watch and follow along with what he's doing. But yeah-
• 25:54
  -Yeah -... we should have him on some time to
• 25:55
  -talk about all the- -I am-
• 25:57
  -... all the cool stuff he's working on. -I, I did, I did play around with the Gemma
• 26:01
  4 model on my work machine, 'cause it's like a 64 gig M4 Max, and-
• 26:07
  -Mm-hmm -... it... like, it worked well enough. I
• 26:09
  don't...
• 26:11
  Like, obviously it's not as quick as the frontier models using-
• 26:14
  -Of course, yeah -... Claude or GPT or whatever, um,
• 26:17
  on a, on a consumer-grade device. But, like, we're getting there, and we're
• 26:20
  getting there pretty quickly,
• 26:22
  so.
• 26:23
  Um,
• 26:24
  just... 'Cause I, I need to run, um, shortly, but I just... I saw this thing
• 26:30
  this morning,
• 26:32
  uh, from Kyle Daigle, who's the COO at GitHub.
• 26:38
  Um, you know, there's, there's been a lot of
• 26:40
  downtime recently. They're struggling with keeping-
• 26:44
  -Yeah -... GitHub up. It's all... They had, like,
• 26:46
  this weird,
• 26:48
  um, merge queue bug the other day where it just, like-
• 26:51
  -Oh, boy -... went and deleted a whole bunch of
• 26:54
  commits from people's repositories and things like that. I think they, they said
• 26:57
  it was something like 2,800 commits across, you know, millions of users, which
• 27:01
  -may or may not be accurate. But- -Oh, gosh
• 27:03
  ... I saw this,
• 27:05
  uh, tweet this morning come across my timeline from Kyle saying,
• 27:10
  uh, that, "Yep, platform activity is surging.
• 27:14
  There were one billion commits in 2025, and now
• 27:18
  it's
• 27:19
  -275 million per week." -Oh my gosh.
• 27:21
  "On pace for 14 billion this year if grwoth, growth remains linear," and in
• 27:27
  brackets, "Spoiler, it won't."
• 27:29
  -"GitHub Actions- -Yeah
• 27:30
  ... has grown from 500 million minutes a week in 2023 to one billion minutes a week
• 27:36
  -in 2025." -Oh my word.
• 27:38
  "And now 2.1 billion minutes so far
• 27:42
  this week."
• 27:43
  -Oh my gosh. -Uh, you know.
• 27:44
  -And, and, you know, it's Monday, right? -Yeah.
• 27:47
  "So we're pushing incredibly hard on more CPU, scaling services and strengthening
• 27:51
  GitHub's core features. And as a fine purveyor of handcrafted shit code for many
• 27:56
  years, I'm not gonna weigh in on that." So-
• 27:59
  ... we- you think, you know,
• 28:01
  two years ago it was just us.
• 28:03
  -Yeah. -Humans could only write so much code,
• 28:05
  -could only test- -That's right
• 28:06
  ... so much code, could only open so many PRs. Now,
• 28:10
  even, even though... Like, y- you would think in our tech sphere, in our tech
• 28:14
  bubble, that everyone's using AI and it's the end of the world and, and whatever
• 28:18
  else. It's roughly
• 28:21
  the same number of people that are now using 5, 10 agents at once to open, you
• 28:27
  know, to work on multiple features in parallel, to, um, ship multiple PRs in
• 28:31
  parallel to, you know, may or may not review them. But every time you fire
• 28:37
  a PR up out there,
• 28:39
  and like for our CI,
• 28:41
  it's
• 28:43
  eight processors or five shards, you know, running at four minutes each, plus
• 28:48
  CI, uh, plus, um, Stan and Pint and whatever else are running. You know, we're
• 28:53
  talking 10 jobs per PR. If everyone's opening up 10 PRs per day all of a sudden-
• 28:58
  Yeah
• 28:59
  ... you can see how this gets out of control. And so-
• 29:02
  Oh, yeah.
• 29:03
  Sure. Yes. Of course. Um, GitHub is struggling, and, and, you know, there's
• 29:07
  people out there that are like, "GitHub was never built for agents."
• 29:10
  -They'd be like, "We're leaving." -It, it-
• 29:11
  -Yeah. -Of course, it wasn't. 'Cause when GitHub
• 29:13
  was built 20 years ago, the notion of agentic development was not even the, the
• 29:18
  -twinkle in anyone's eye. Um- -Mm-hmm
• 29:20
  ... and so
• 29:22
  -the fact that it's still up 89.8%- -Right
• 29:25
  ...
• 29:26
  of the time is ridiculous. And people talking about, you know, who's building
• 29:31
  the next GitHub, I'm like, "How do you solve this problem?"
• 29:36
  -Who, who has got- -Oh, no. It's-
• 29:38
  -Like, we're talking Microsoft here -... who has the resources, the developers-
• 29:41
  Right
• 29:41
  ... the funding? Who has all of that stuff-
• 29:42
  -We're talking Microsoft -... in order to be able to build it?
• 29:44
  You know? Um-
• 29:46
  -Yeah. -What, what do we market... What is the
• 29:48
  market cap? You know, how, how big a company? They, they're a $3 trillion
• 29:51
  -company. -Yeah.
• 29:52
  -Right? Now, obviously GitHub is- -Yeah
• 29:54
  ... is probably only a tiny fraction of, of Microsoft's portfolio,
• 29:58
  but we're talking about a $3 trillion company. Um,
• 30:04
  what...
• 30:05
  Who, who's coming in? Who's bigger than Microsoft that's gonna tackle this
• 30:09
  -problem? -Yeah, who's disrupting that?
• 30:10
  -Well, and, and that- -Totally
• 30:11
  ... that's not to say that, like, more money is gonna solve the problem.
• 30:14
  You know, it, it's gonna be innovative thinking, it's gonna be, like, looking at
• 30:18
  this in a different way. It's gonna be building something differently to support
• 30:22
  this. But-$3 trillion worth of resources. Who is going to solve
• 30:28
  the problem that agentic development and, like, the sheer volume... And, and it's,
• 30:33
  you know, I say it's largely the same number of people, but you've obviously got
• 30:37
  the outliers, the people that, you know,
• 30:40
  the, the people that were around the peripheral, CEOs, COOs, CTOs, product
• 30:44
  people, marketers that are now building stuff that they couldn't build before.
• 30:49
  Okay, but we're still not talking a huge... Like, we're not,
• 30:52
  it's not 100% growth or a 200% growth. It's still a small percentage on top of
• 30:57
  what was there before. And, and the volume is still growing so much more. So it's,
• 31:03
  um, it's the... And
• 31:06
  the thing is compute. Everyone's fighting for the same compute resources. Anthropic
• 31:10
  wants all the, all the GPUs and, and the RAM, and OpenAI wants it, and xAI wants
• 31:16
  it, and Microsoft wants stuff, and
• 31:18
  AWS wants stuff. We've got local providers here that cannot get hardware to put in
• 31:24
  their data centers. They're just out of capacity, and they can't...
• 31:27
  You know, normal growth, sure, they've reached capacity, but they cannot buy more
• 31:31
  hardware to put into their data centers now to bring on more customers because
• 31:34
  they just can't get access to the hardware. So
• 31:37
  even if you had the capital
• 31:41
  to, to solve the pro- You, you physically cannot solve the problem. We can't build
• 31:44
  data centers fast enough. We can't power them. We can't
• 31:48
  cool them. We can't, you know, all this stuff.
• 31:51
  Um,
• 31:52
  it's just an interesting, interesting challenge that we've, you know, we've
• 31:56
  created it for ourselves, um, but it's not gonna be solved
• 32:00
  quickly or easily or cheaply, for sure.
• 32:03
  Yeah. Okay. How much time do we have left, Michael?
• 32:07
  I mean, we're at 33 minutes now, and I've, I've gotta-
• 32:10
  -Okay -... go and look at some paint, so very
• 32:12
  -exciting stuff. -Okay.
• 32:14
  We should talk about, next time we should talk about, oh, what is it called?
• 32:20
  Basically, it's processors that use light rather than electrons. Um,
• 32:26
  -can't remember what they're called. -Quantum? Are we talking quantum?
• 32:29
  -Nope. -What was the question?
• 32:30
  Not quantum.
• 32:32
  Not a question, more of a... Well, so it's like-
• 32:34
  -What was the... What did you say? -There are these processors that use phot-
• 32:36
  I think they're called, like, photovoltaics or something like that.
• 32:38
  Like, photonic. No, photonic processors, I think is what they're called.
• 32:41
  -Okay. -Photonic processors.
• 32:42
  -Right. -Have you heard of these?
• 32:44
  No.
• 32:45
  No. Okay.
• 32:46
  The, the, we should talk about them next time.
• 32:48
  -Okay. -The long and short, though, is I was
• 32:50
  thinking, like, quantum is gonna be the thing that's going to help solve all the
• 32:53
  problems for, like, AI stuff. It's not. Quantum actually doesn't apply very well
• 32:57
  to,
• 32:58
  -to this problem that we have. -Mm-hmm.
• 33:00
  Which is, like, matrix multiplication, right? Running, running vectors through
• 33:03
  these matrices multiplications and then getting outputs, right? That's all AI is.
• 33:08
  Um,
• 33:09
  and
• 33:10
  obviously, with the current set of processors we have, there's only so... You
• 33:13
  can only flip bits so quickly.
• 33:16
  -Mm-hmm. -And they also generate heat because the
• 33:18
  electrons are colliding with actual atoms and generating heat, and so you have to
• 33:21
  deal with that heat, and the speed is an issue.
• 33:24
  And so these photonic processors actually use light,
• 33:28
  and it's really cool because light,
• 33:32
  th-
• 33:33
  because of the way it works in physics, it actually does matrix multiplication
• 33:38
  natively,
• 33:40
  like,
• 33:40
  using physics. It's not like a math operation like it is with flipping bits on
• 33:45
  -and off. -Mm-hmm.
• 33:47
  So, like, if you take a red wavelength and a blue wavelength and you combine them,
• 33:51
  they multiply basically to give you, like, a purple wavelength, right?
• 33:55
  -Mm-hmm. -So it's just, it's like physics, the way
• 33:57
  that it does the multiplication,
• 33:59
  and it's also insanely fast. Like, it's faster than the speed at which we can flip
• 34:04
  bits.
• 34:05
  Um,
• 34:06
  and so these things are coming on which, these, these photonic processors, which, I
• 34:11
  mean, will maybe even solve some of these problems of heat and power and speed,
• 34:16
  right? How cool would it be within five years
• 34:20
  if all of this AI stuff and the NVIDIA hype is just like you don't need it
• 34:23
  -anymore? Like, we've got these- -Mm-hmm
• 34:24
  -... photonic processors that basically- -Mm
• 34:26
  ... solved
• 34:27
  80% of the problems,
• 34:29
  and now we just can rip like crazy with these, with the models. Like, it'd just go
• 34:33
  nuts. Um,
• 34:35
  I tell you, man, like, it doesn't seem far off that, that it could be that way. You
• 34:39
  know, there's all these problems that are arising right now because of all the AI
• 34:42
  stuff, but it's like it's still such an early technology it feels like.
• 34:44
  -Yeah. -Um, and it's helping us to innovate so
• 34:47
  quickly. I could see having solutions to some of the problems that it's creating
• 34:51
  right now within the next short span of time. And then it's like, you know, all
• 34:55
  these bottlenecks you're talking about, maybe they become not problems anymore. I
• 34:58
  -don't know. It's pretty interesting- -Yeah
• 34:59
  ... stuff. But we can talk about that next time.
• 35:01
  Well, I mean, we, we're, we're either gonna have to overcome or we're just gonna
• 35:04
  have to... Well, we've, we've come too far now to give up on it, so there's gonna
• 35:07
  -have to be- -Totally. I mean-
• 35:08
  ... some way around it. Someone will figure it out.
• 35:09
  But everybody's... Totally. Uh, they've got to, but everybody's operating at,
• 35:13
  -like, a loss right now, right? -Mm.
• 35:14
  I mean, like, they're gonna... We're not paying Anthropic enough to actually run
• 35:17
  these models, I don't think. You know what I mean? Like-
• 35:20
  -No. -Um-
• 35:20
  -No, we need- -But it's, it's, it's a capture the market
• 35:22
  sort of game right now. So
• 35:24
  -anyway. -Mm-hmm.
• 35:25
  Yeah. Somebody's gotta figure it out. You're right. And, uh, hopefully,
• 35:28
  hopefully we do. I think we probably will.
• 35:29
  -Yeah. -But
• 35:30
  this is probably a good place to stop this one. 192.
• 35:33
  -Mm-hmm. -Is that right? Episode 192, folks. Find
• 35:36
  show notes for this at northmeetsouth.audio/192. Rate us up in
• 35:39
  your podcatcher of choice. Five stars would be incredible. We'd really
• 35:41
  appreciate it. And hit us up with any questions on X @michaelthurner,
• 35:44
  @jacobbennett, or @northsouthaudio.
• 35:46
  All right, folks, till next time. We'll see ya.
• 35:49
  Hey.