Jerod Santo: Yes. The toilet’s meant to detect a range of disease markers in stool and urine. So that’s like legit supposed to be helpful, but it’s just too funny to even talk about it with a straight face. So I’ll throw it in the chat, I’ll put it in the show notes… But this has been –

Adam Stacoviak: The GitHub founders were on that show, three months after GitHub’s inception. So we talked to Tom Preston-Werner and Chris Wanstrath in the offices of Pivotal Labs, I want to say May 2008. And I think it was incepted like January, February maybe… So legit right after GitHub was GitHub.

Jerod Santo: Gosh, I wish we could somehow – I mean, maybe even in bootcamps… I’m thinking beyond your bootcamps specifically, but a lot of teachers in more of a startup bootcamp ecosystem, if you will… A lot of these people are day to day practitioners, who then decide to teach. I mean, I did it for a little while myself, teaching web development… And for me, I was doing web development all day long, so I had that credential, and I had the legit real-world experience, but I didn’t really know how to teach very well. So I had that problem. Like, I didn’t have a PhD in education like yourself. And so a lot of us practitioners though, out there doing the work, with our hands in the dirt - we don’t necessarily know how to pass on our knowledge very well… And so there’s kind of a mismatch there.

Dylan Hildenbrand: Very nice. Yeah, so I was also approached by a publisher. One of my earlier roles in web development was actually for an advertising agency building WordPress themes for their clients. Customers need websites, and they need to advertise, and so I was the one who was making the websites happen. When I started that, I realized I quickly needed to learn more about WordPress, because I had no experience with it at the time… And so I spun up an old Pentium 2 PC that I had hanging out in one of my closets, I threw a lightweight Ubuntu distro on there, and I put WordPress on it and I started tinkering and tinkering. And I’ve been tinkering on that same installation for 10 years now, and that’s where I write closingtags.com, which is my blog about web development. It’s mostly just content that any problems I come across and solutions I come up with, I say “Hey, this would be a great blog post”, because I’m constantly finding other people’s blog posts. It’s mostly there for documentation for myself, and I have comments enabled, which is great when people say “Hey, this really helped me. Thank you.”

And so I’d written a post about getting global CSS in SvelteKit. At the time, SvelteKit wasn’t out of beta yet, so we’re not even in SvelteKit 1.0, and there wasn’t a defined method for doing this outlined in the documentation yet. I’d come up with a relatively hacky strategy, and written about it, and it got a lot of traction. It’s one of my most viewed posts on the site to this day, even though it is now incorrect. I’ve put a little disclaimer at the top of the post saying “By the way, Rich Harris said don’t do it this way. Do it this way instead.” But it happened to land in GitHub issues where a lot of people were saying “Hey, how do I do this?”

[10:04] Somebody linked to it, and from there, a publisher came across it, and they reached out to me and said “Hey, we want a book about SvelteKit. Would you be interested in writing it?” And like Adrienne said, it seemed like “I don’t know, this seems a little bit scammy, because I got an email, and they’re like “You should write a book.” I was like “Yeah, that’s obviously a scam. Somebody doesn’t know what they’re asking…” But then I kind of dug into it a little bit more and realized “Oh, wait, this is how this publisher actually reaches out to people.” And so I kind of asked some questions, and I set up a call to make sure things were legit… It was totally legit, and the rest is history.

Chris Benson: Which seems completely legit to me, because you’re representing everything appropriately. You’re not pretending, you’re not getting around, that kind of thing. You have a tool, and frankly, I could use a few of those in my life, and just take care of all the things. But I’m probably not going to call anyone and have an AI model pretend to be Joe Biden or anybody else. So…

Adam Stacoviak: What an absolute shame. Legit. I mean, to have your brain not with you, basically…

Jerod Santo: [win alert] It’s legit! Number five. It’s the least popular of the most popular. [laughter] Worth 50 points. Holy cow. And we go back to Adam. There’s just the number two slot on the board. I will say that in this particular category, I did zero lumping. There is no lumping. And I will say that that might be a hint. You’re up at, Adam.

Jerod Santo: No idea what’s gonna happen. And I have to say, most of his jingles are funny contextually, and you can tell he has skills and musician abilities… But “Backslashes are trash” is a legit good song. It gets stuck in your head. I go back to it and listen to it sometimes. It was so funny, it was so on point… I love that song. I just go back and listen to it just because.

[00:45:56.07]

I don’t mind ash, I don’t even mind Bash… I like caching and cache, and I’ll clash with a dash in a flash, man… I’m not gonna say gosh, I don’t even mind hash… I’m out on the lash, man. I’ve got a rash. Oh my gosh, man, I’m gonna smash your face in if you backslash me. That’s trash! Backslashes are trash… Backslashes are trash, yeah… Backslashes are trash. And don’t say forward slash… Just say… Slash… Just say slash… Just say slash… No need to say that forward bit… Just say slash.

Jerod Santo: That sounds legit.

Amal Hussein: Wow. So just to be clear – so first of all, I’m just mind-blown at this, because I’m thinking of how much JavaScript and CSS and HTML can be deleted from the web, now that this is built-in, legit… And just to clarify this, this is a little bit of a crossover between HTML and CSS, right? Because popover is an attribute that you have to put on an HTML element.

Amal Hussein: Yeah, legit. Legit. Alright, well, with that said, Saron, where can people follow you, get in touch with you? How do they subscribe to the newsletter? Tell us all the things.

Jerod Santo: Here’s a question. I tend to agree; you’re getting popular. But is there a context in which that is legit? Like, it’s tech conference, Monday morning… You’ve painted that particular picture. But is there ever a time where you can reject their level of enthusiasm appropriately?

Natalie Pistunovich: Everything is legit in this section.

Adam Stacoviak: It’s funny, when he said TerraForm there… I’m not even kidding with you, I legit thought you said tofu. [laughter]

Kevin Ball: Totally. And you may go through periods in your life where that’s what you want, right? Like, it’s okay to choose to say “You know what, I am happy doing my work on my own. I don’t want to interact with any of these people. I don’t care if I advance, I don’t care if I have greater impact”, all these other things; that’s totally legit. It’s okay to say that. But know that you’re saying that; know that that’s a choice.

Adam Stacoviak: It makes me also think about these problems at scale. This is a small scale… And I think it’s part of the beauty of kaizen, and continuous improvement at our scale. We’ve done things like Linode and Kubernetes… Not Linode in particular being a bad choice, but Kubernetes is not necessarily a smart choice for us to do, because we were in a single node for a long time. It’s obviously better multinode, and there’s much bigger problems that Kubernetes solves… But we get to sort of expose these very small problems, really; I mean, we’re talking about 100 bucks, really, in cost… It was incorrect, and we’ve hunted it down through like “Why is this bill growing?”, paying attention, iterating, all collaborating… I just wonder, at larger scales, with larger teams, who just have multiple teams with legit AWS billing issues, like hundreds of thousands of dollars, hundreds of machines even, hundreds of instances, and how this problem permeates in a team at scale. I mean, how much money is being wasted, really, by holding it slightly wrong, or completely wrong.

Adam Stacoviak: Yeah. It should have been five; it ended up being four. It’s a legit home theater.

Jerod Santo: I actually thought that was legit… I thought it’d be a decent answer. But we all know that they can make stuff up all the time. [laughs] But I did like the response.

Haroon Meer: Yeah, I’ll tell you two interesting versions of that. The one is - and I feel strongly on this - is one of the original sins of the security industry is them promising too much, and trying to be too much. And sometimes people need to be able to say “Yeah, we don’t do that.” Like “Yeah, we wouldn’t catch that.” If you know where all the Canaries are, and you don’t touch them – like, you know where all the tripwires are; that stuff’s not gonna catch you. And I think people should be okay with saying that. And our pitch to try to mitigate against that is that we want to make things that are easy enough to deploy, that a person can deploy it without letting the whole company know “Hey, here’s what I’m doing. We’re doing this Canary rollout.” Like, literally, go plug it in, forget about it. It’s in that corner. It doesn’t need huge shenanigans.

And Canary tokens add trickiness, just because they could be anywhere, and they could be – we’ve given a few talks on Canary tokens, because some of them are really dependent on how tricky the security team wants to be. So some of them are obvious, like that AWS API key that I mentioned. But we’ve got another one, for example, that’s a legit WireGuard endpoint. And so you take your CEOs phone, and you add a WireGuard tunnel on his phone that says “Secret exec network 123.” And you forget about it. And what you’re waiting for is when he gets his phone compromised, when he’s going through customs into China, when that phone gets grabbed, it’s the sort of thing that an attacker who you’re interested in looks at it and goes “I see. I’ll use this endpoint. I’ll check what this is.” And our pitch is, if we can make those things easy enough to do, then security teams can do them.

And so if you take – I know lots of vendors use it, but if you take people having their SolarWinds moment, where attackers have compromised the build server deep in a network, and the only time they find out about it is after the attackers used the build server to build new software that’s been deployed to all of their customers, that sort of attacker who finds AWS credentials on that machine has to try to use them. Because maybe that’s SolarWind’s cloud environment. Or if they find a VPN endpoint on that machine, they’ve got to see what’s at the other end of it. Which means in week one you get notified that a machine nobody should be touching is doing strange things, instead of waiting till you read about it on CNN. And mostly that’s our pitch, is “Do this now, forget about it. It will be good for you.”

Adam Stacoviak: Legit, yeah. And they will find conspiracy in conspiracy. That’s –

Jerod Santo: What if six months down the road HashiCorp sees the light, and they’re like “Holy cow, OpenTF is legit. Everyone’s using it. We’re losing market share. This was a big mistake. BSL be gone, NPL comeback. We would like to join the OpenTF initiative”, is there a potential of a merge? I mean, you said war at this point. So it doesn’t sound like that would be on the table.

Jerod Santo: Here’s how far I’ve gotten, but I haven’t pulled the trigger yet, on trying to actually have a malware/spam detection system for Nightly that’s actually good… Is I take a list of a bunch of good repos. Here’s what we have: owner, which is like GitHub handle, repo, which is the name of the repo, and then like the description. That’s what we have. And I took 20 good ones; these are legit, but they’re diverse… Because you can put emoji in there, some people write in different languages etc. And I pass it off to ChatGPT, and I say “Here’s an example of 20 good projects on GitHub.” And then I pass it some bad ones and I say “Is this one good or bad?” and it’s about 60% accurate.

Adam Stacoviak: Well, that’s not the truth here in Texas, though. I mean, the Texas barbecue folks - it’s like a community, similar to the way software is for us. They get together, they share “Oh, what’s your method here?” And they’re sharing constantly. There’s no secrets, really. I mean, there’s obviously some secrets, because there wouldn’t be any if there wasn’t any… But they’re not trying to try to keep the secrets, you know? It’s like time and temperature is the primary thing. You can cook it on a Traeger, which is wood pellets, or you can cook it with legit post oak, which is legitimate wood, and tending a fire. But it’s really just time and temperature, seasonings, rubs, whatever…

Natalie Pistunovich: I think last year there was a bit of a hype against threads, and I think it’s still legit. There’s very few threads that should be threads.

Adam Stacoviak: And this is both our, I guess, initial ZFS box. It serves many purposes, but I built it to be the Plex machine, but it also does a lot of storage, because I haven’t built the second machine yet. So I’ve got one, I plan to have two. And the second one will be called something else. But yeah, I’m SSH-ing into Linux boxes; Raspberry Pi’s, legit Linux boxes, other machines, whatever it might be.

Jerod Santo: Right. Can we just rant real quick about password requirements, too? Like, it must be between 8 and 20 characters, it must have a special character, it must have a number, and a capital… It’s like “Just leave me alone.” The only one of those that’s legit is it has to be longer than x. And x should be like eight. Four to eight. Don’t put a maximum limit on my password. Ridiculous. Don’t require – anyways…

Scott Johnston: I think it was a decision that was well-intended, but wasn’t fully informed. And that’s on us. I’m not saying that someone else was responsible for informing us. And what I mean specifically though is that there is actually a fantastic product for open source projects on Docker, being distributed through Docker Hub; it’s called the Docker Sponsored Open Source Program. It’s a really strong product, meaning it’s got no rate limitations for any of the users pulling images from their accounts, it has a preferred results that pop up in the search as developers are doing searches for content… So if you’re a Docker Sponsored Open Source, you appear higher in the results… It’s got a badge associated with it, so users that are crawling over Hub can see that “Oh, that’s legit.” And it also gives those publishers publishing stats and analytics so they can see who’s using it, or how it’s being downloaded, what’s popular tags, and such… So it’s actually a much better experience than just kind of the free team product that was out there.

[38:09] And the intention was to guide those users, which is about less than 1.8% of the overall base, but it was, as we found out, a very vocal percent… Our intent was to guide those users to this better product. We didn’t fully appreciate how difficult that was for them from a tooling standpoint, we didn’t fully appreciate the breadth and depth of the surface area in the open source project community… And as a result, after a week or two, we’re just this like “We made a wrong call here. We didn’t have full understanding of this community as we should have.” And hence, we reversed the decision.

Adam Stacoviak: [46:18] Even this show here - this show was named something else. No, not the show. Changelog News was named something else for a bit there. And up to like the legit 11th hour, was it renamed back to something that was more meaningful, I suppose, to the brand?

Angie Byron: Yeah. I like Ivan, because they legit don’t want vendor lock-in. If Ivan makes you angry, you can take your Kafka and move it to Confluent, or whoever you – I’m probably not supposed to say that word, but anyway, you know what I mean. It’s like, it’s fine, because what we’re trying to sell is like “Hey, we’re the security layer on top of your thing. We’re gonna do the updates for you, this kind of stuff”, so that you can then be like “Great, I don’t have to worry about that. I can just write the stuff my business cares about. Because they don’t care if I’m running a Kafka cluster. They don’t care about that. They care about the results that they’re gonna get.”

[01:18:05.25] The other thing I like about them is a lot of companies will try to make money off of open source. That’s why we’re all here. This conference is very enterprise–

Jerod Santo: In what appears to be a particularly security-unaware move, Google has added eight new top-level domains, two of which are quite concerning: .zip and .mov. Yikes!

Ars Technica writes:

While Google marketers say the aim is to designate “tying things together or moving really fast” and “moving pictures and whatever moves you,” respectively, these suffixes are already widely used to designate something altogether different. Specifically, .zip is an extension used in archive files that use a compression format known as zip. The format .mov, meanwhile, appears at the end of video files, usually when they were created in Apple’s QuickTime format.

Phishers and scammers rejoice! The rest of us… beware and be ready to help protect your friends & family from this otherwise completely avoidable new threat vector. The linked Ars Technica article demonstrates a few URLs scammers could now craft and they’re darn near indistringuishable from the legit URL even to someone like myself with trained eyes.