This is identity at the center. If it has anything to do with I am, This is the go to podcast now your hosts Jim McDonald and Jeff Steadman. Welcome to the Identity of the Center podcast. I'm Jeff and that's Jim. Hey, Jim. Hey, Jeff, how are you? Oh, not so bad. Yourself doing great. I wanted to bring up the call that we had the other day, Megan and Adrian from over at the Authenticate Conference of Fido Alliance and that we're going to be on the Mainstage on the first day. Scary.
And what it Well, it is a little scary, believe me, it's a little scary. But what I thought was really cool about or what I thought was like hilarious, I thought they were pulling our leg because I said. You know, how long, how long of a session are we looking at? And they're like, oh, like an hour and a half. And I thought, oh, that's funny. That's really funny. But it was serious. So who knows how long it'll be?
Yeah. Because, you know, the more I give it thought after after the fact, I was like, you know, we could we have a lot of fun with an hour and a half. What do you think? We definitely could. I I don't think we've actually done an hour and a half on this podcast. I think the closest we've got maybe is like an hour 10 hour 15 even that we feels are really long like most people I think. Prefer us to be around 45 or 50 minutes, but sometimes we just go on and on.
We just can't get enough of our own voices, apparently. We try to make it sound natural too, but we could have a lot of fun. I think we'll probably settle probably on just under an hour or something. That probably makes the most sense, but. Yeah, it'll be interesting. We'll be up on the main stage and I think we're, I think technically we're a keynote, you know we're looking at doing like a live.
We haven't figured it out. So this is obviously all subject to change, but I think the idea is to do almost like a live. Podcast episode in front of people, Try to get some guests to come on, maybe talk about different issues and things that are going to be referenced throughout the conference. But yeah, it's very cool. Yeah, the Authenticate conference is coming up. We'll be there. We've got discount code ID AC15, podcast ID AC15, podcast. Get you 15% off of your registration.
So definitely use that. That's a good way to show support. You know, for the for the podcast itself, it's October 16th to the 18th. It's in Carlsbad, CA, so nice on the beach, a little bit north of San Diego. I think it's on a golf course. So yeah, kind of a nice deal situation. I've got to say, I'm not, I'm not proud of this, but I do kind of judge conferences based on where they're located. 100% that
and their cookies. Yeah. So I looked at, I was doing it a meeting we had today and there was. You were on it. Few other friends were on it and we jumped on Google Maps and I brought up there's a four drop conference way back in the day at the Asilomar Conference Center. I was like that was probably one of the coolest conferences. I was at this one also and they also had another one at Half Moon Bay. This one, this location looks just as good man. I mean it is like Primo
location. So if you're on the on the fence. I'd say the location should put you on the other side of the fence. Yeah, for sure. I mean ideal location, good time of year, October, I mean it's great. It would be great weather. It's California, so it's always pretty good, but that's a good time of year. But yeah, so that's our, that's our plug.
Come visit us, come visit the Authenticate Conference, come support Vito, come support us. We'll have links in our show notes, Authenticate Con Co, n.com is where you can go to find more information, make sure you get that hotel booked so you can stay. You know, at the resort that it's at, you don't have to like take an Uber that's always, that always sucks man conference. And you're like, it's not
convenient. It's just it makes a world of difference to be right there rather than having to commute in every day. Absolutely, yeah. And it's also not like Vegas, where you can just walk from hotel to hotel. Right. But even that could be like a 45 minute walk just to come from. Hotel to another. Yeah, a. 150 degrees outside too, yeah. We're going to talk a little bit about identity standards and stuff.
You were talking before we get started that you wanted to get provocative with it. I don't know how you get provocative with an identity standard, but I think you're going to try. If the podcast just cuts off unnaturally, we went too far and we said that was not family friendly. Yeah, or if you hear like awkward edits of me trying to like carve out, like, yeah, we probably shouldn't have gone there or something like that, so. Maybe I think we'll be okay, but
why don't we get into it? We're going to talk identity standards today as a guest. We've got Justin Richer. He's the security and standards architect and he's the founder of Bespoke Engineering. Welcome to the show, Justin. Thank you so much for having me on. Thank you so much for joining us. We're going to talk a little bit about your identity background and just start peppering you with a whole bunch of standard stuff, cuz you've definitely been a major player in this
space. One, I'm going to compliment you again on your audio setup. You've got the nicest mic I think we've had yet on the show. You've got your whole audio setup. I know you do music. We're going to talk a little bit of that later. But I really appreciate it and it and I mentioned this before, we hit record the breath control and the mic technique.
This is an audio podcast, but we have video that we run behind your the scenes just to kind of you know, help us kind of coordinate who's talking and stuff like that and for those who aren't familiar. You know, when you're talking into a microphone like we are, you want to try and get away from, like, mouth noises, right? And breath sounds, like, right. That kind of thing. And we were like getting prepped and like going through our preflight checklist, right?
And all this stuff. And I noticed that as you were, as we were talking, you like, put your head to the side and like, did your exhale so it would go around the mic. Chef, kiss my man. Thank you so much. Happy to help, but yeah, I did radio back in high school and in college and we didn't have nearly as nice a gear at the little College Station. So in order to not completely trash the on air sound, you learned a few things about how to clean up the signal. Yeah, for sure.
I go back and occasionally I listen to the first episode of this podcast. It's on a condenser mic. It was a blue Yeti, I think it was very echoey basement, no sound treatment. I mean it sounded fine for you know, we had no idea what we're doing. And then you Fast forward now it's like okay now we we still don't know what we're doing but at least it sounds a little bit better. So gives us a little more
credence of that. Let's talk a little bit about your I M background because you have definitely been really. At the ground level of a lot of the stuff that a lot of organizations use for authentication, potentially some authorization stuff, but we always like to have a little bit of the origin story when it comes to identity. For our first time guest, how did you get into the Identity and Access Management field? Is it something that you chose
or did it choose you? It definitely chose me, so my. My research background back when I was in undergrad was actually in collaboration systems. So getting people to work together to talk together a field that eventually became known as sort of, you know, social computing. And that led into the whole web, 2.0, blogs and wikis and everything else when all of that was new.
But in working with all of those systems, you know, obviously you need to be able to identify people, you need to be able to connect systems together, You need to. Have security on all of these things or else it just you know
stuff doesn't work. And I was finding that through all of these projects, you know as a you know an impetuous young engineer I would build the thing put it out and then our info set group at the place where I work to be like, yeah, no, turn off all of the functionality and that's that makes it secure. And it's like that's you know you're you're missing the point like that's the the point is to go do all of the things that
we're doing and. After going through that experience a few times, I realized that, you know, I really should learn what the security side is looking for and sort of get involved in that space. And that's how I got involved with kind of looking at things with a security and access and all of that mindset. But as a consequence, because I kind of fell backwards into that space, I tend to approach a lot of security architecture in a
way of looking how can we get. The most functionality possible and still make it secure. So focusing on that functionality side of things and it's like okay, this is what we want to do, this is what we need to do and how do we actually, you know, make that function secure As opposed to how do I shut off as much as I can in order to make it as secure as possible Because at the end of the day, a system with tons of security and no functionality is useless.
But a system with tons of functionality and no security is the most popular app that everybody has ever used, right? And then this is this is just true time and time again. Yeah, and I find also to like bad security is like a rock and a river. People will just find a way around it. And Oh my gosh, yes, it's the in the workarounds often tend to be much worse than the thing that you were trying to prevent in the 1st place.
You know, we tell people like. You know, come up with a complicated password that means people are just going to write it down because they're not going to remember it. And all of these things end up working counter towards the goal of the security engineering, like what you were actually trying to do, because it gets in the way of people actually doing
things. And I think that that kind of disconnect is a real problem in our industry on the security side, on the identity side, people aren't often looking at. Sort of their little slice of the world in a bit of a vacuum and trying to figure out, like, OK, so how can I make my little bit the best that it can be without looking at the larger context of where everything comes together?
In my opinion, there's a there is an academic paper that should be required reading for everybody, and that's it's from 1988 and it's Gruden at all. Why collaborative? Computer supported collaborative work systems fail, and in this paper they look through a digital calendaring system that was bought by the management of a company and then handed to the admins. And as far as the management was concerned, it had all of the features and everything that they cared about. It was brilliant.
But the admins who would actually manage all of the calendars and that were like putting things in for these executives. It was atrociously bad. And this disconnect between the people that are sort of designing and selling the system and the people that actually have to use it to do something at the end of the day was just
insurmountable. The entire system was a massive failure and led to the writing of this paper and and in in my in my opinion this paper should be like day one reading of anybody getting in to really any type of. Human facing computing at all. You know, just as you're talking about this, I'm also thinking of kind of the security architect mindset almost has to be creative in a way, right? It goes beyond just, you know, it's not like a type, a personality type, a personality kind of.
I don't want to say it as excluding people, but really you have to. Be able to use that left half of your brain mm. HM Yeah, Because you need to be able to think in sort of all of the weird ways that people are going to use the system or apply it to things that you can't expect and be able to adapt to that. And, you know, that's. Because, you know, fundamentally, identity systems are all about where this stuff starts touching people, where it starts dealing with people.
And people are weird and squishy, and we do things that are, like, really unexpected. And so when you're designing a security architecture, you have to account for that weird and squishy stuff. Yeah, two of the things that I used to do when I was doing some software engineering. Courses and having to write some programs was I'd find that sometimes my brain was very active and I had to have like a
notebook nearby. I had to keep a notebook next to my bed because I could wake up in the middle of the night with the solution or be going, you know, drinking, you know, a lot of caffeine. And my mind would just become so active in the ability to kind of solve some of these problems. I'm wondering, is that what you experienced as well?
Yeah, I find that the the ability to kind of background process hard problems is really important when especially when you start getting up into sort of the architecture level of stuff, when you're looking at systems and systems of systems and how stuff comes together, there's there's a lot of stuff that you're not going to notice right away. But. If you engage in with the problem space, you're going to kind of keep thinking about it. You're going to kind of like keep percolating on it.
And then you'll come up with sort of these, you know, interesting and creative approaches to things that you wouldn't have if you were just sitting at a desk saying, I am solving this problem right now. And so for for my part, you know, I'm, I'm an independent consultant. I have worked from home for the last eight years.
So for me the the whole switch to virtual meetings meant that everybody else was also working from home during all of these meetings that it didn't really change that part for me. But what I've found personally helpful is I I ride my bike a lot. I I do, you know between 10 and
20 miles a day. To just get out there, clear my head and let things just kind of background process and that type of contemplation I think is not really valued enough in the technology industries nearly as much as it should be because that's that's where creativity happens that's where this kind of like. You know, I got an idea of a way that I might be able to approach it.
I don't know if there's something there yet, but when I get back to my desk, I'm gonna, I'm gonna try this thing that I hadn't thought of before. And you see where that goes, See where that lands us. You know, I think this is this is really interesting topic because I feel like we scheduled. We get so busy during the day, right? You're jumping from meeting to meeting to meeting and there's no time to think. It's just I'm reacting all day long, right?
Absolutely. Yeah, I think it's important to to, I hate to say it, but schedule time to think, right? Maybe if you it's bike riding for me, it might be playing video games you know, whatever it may be, right? Inspiration can kind of come wherever. But we don't. I I feel like it's a trap that a lot of us get into is we don't actually take the time to think about something. Yeah, absolutely.
And it's something that I've had to explain to some of my clients over the years is just like, well, you know, I am, I am going to basically, you know, get up to speed on this project, which means I'm going to go and read a bunch of stuff and think about it and that takes time. That doesn't seem like that
would be a billable activity. But me actually writing a document for you or developing software or, you know, giving you guidance on how to engage with something, none of that can actually ever happen unless I can get to the state where, you know, I have had a chance to think about things. I have had a chance to start to piece these things together and
be able to bring that forward. So yeah, if you need to schedule time to think, absolutely do it. I like I I encourage it Back when I had, back when I had a real job, I used to block out parts of my day to to just not be in meetings constantly and highly encourage people to do that. You know value your own time. And the other thing that took me way too long to figure out in in sort of the corporate space. That you don't have to go to every meeting you're invited to.
Sometimes you can just not go, and it feels wrong. But you know what it Sometimes you're more valuable not being at the meeting. And that's a really hard lesson to learn because we're told like, oh, you have to be there. You have to be in the room when it happens. The thing is, like most meetings is not where things happen, right? That's that's not really what meetings are, are. Are good at meetings are not
about getting things done. Meetings are about sort of getting a direction, getting some cohesiveness and then you get out of the meeting and get things done. And so you got to make sure that you have the time to get things done and that's that's really, really important. Yeah, I I I think we probably just end the show right here. The the sound clip it, you know, sound bite is meetings are not where you go to get things done. Yeah, There we go. Done. Thanks for listening, everyone.
And yeah, we'll go for the next one. No, no, I think you're totally right on. You know, I think a lot of people don't understand that they control their own schedule, right? And you need to be able to control it. Or they're told that they don't control their own schedule. Right. And I think sometimes can be challenged, especially for maybe people who are newer in their careers, newer with an organization, you want to make a good impression and blah blah, blah, right?
But I think I'm with you. It's like, you know the. The the older I get and yes, the higher I go up with an organization, I feel like I do have more control over things. Sometimes I don't. I have less control because sometimes there are things like, no, you have to be there. And 100% it is going to be a waste of my time, but I need to be there, so be it, right. Those are there will always be those. But yeah, I think this is something I talk about with my team.
Jim knows this as well as you know, you control your schedule. It's okay to say no. I had a manager once, very long time ago, my food service career. The customer is not always right. Absolutely. So it's it's funny that it, it's fascinating to me that you brought up that phrase because one of the things that I did learn, so I previously worked for a company called Miter for 15 years. They're a big systems engineering company, do a lot of research for the US federal government.
And one of the things that I really got to learn while I was there at Miter was that the customers that we were talking to, it was. They would come and tell you what they wanted you to make, right? I need you to build this system. But the thing that the customer says, the thing that the customer wants and the thing that the customer needs are three very, very different
things. But it was really impressed upon us, in my group at least, that it was our job to be able to figure that out and be able to articulate to the customer that like, well, hey, OK, you, you said you needed something that did this. But your actual problem that we're seeing is actually more like this. And so we're looking at doing this type of thing.
And because we were a research arm, we could be a, you know, a little bit more like, hey, here's a weird thing that we, we think is going to address something and here's why. And our customers were a little, little more accepting of that. But you know, you you need to be able to at least tell the difference between those things and be able to tell that story. A diplomatic customer friendly. Absolutely, absolutely. One of the other things that I that I'm really grateful for.
You know, my my department head at MITRE taught me that it doesn't matter how right you are if nobody's listening to you. And that as a you know, hot headed young engineer, that was a really hard lesson for me to learn in my 20s and it took took me a long time and I'm still learning it, I'm sure. It's a but it is absolutely a journey.
It is absolutely a journey. But, you know, you need to be able to bring people along on that story and be able to sort of engage with people that it's not just hi, here's the solution. Shut up and do it. It's hi, here's the solution and here's here's why I care. Here's why you care and figure that out. Especially especially in cases where. You're going to be wrong in some way or another and you just
don't know how yet. And so being able to have that conversation of like yes we need to do this and have somebody be like but that's going to break my database and it's like okay, why is that going to break your database. Let's let's figure that out and and it it may upend the entire set of you know. Poorly defined requirements that you were working with in the 1st place. Or it may just be a little tweaked to something you don't know until you have that conversation.
I wanted to throw out a couple since we're all sharing Nuggets. I think some of the one of the early career Nuggets and it kind of goes with the you don't have to be in every meeting is that it's better to be known for one really awesome thing instead of a couple of mediocre things you know. So if you get so spread out it's like, yeah, you're on every project and. We all go okay, that's not as good as like, hey, you're on this digital identity project
and it was awesome. Like it changed the way the organization works. That's my experience. Anyway, #2 later in your career is kind of, I guess, know thyself, know what really gets you. So for me, digital identity if I focus on digital identity though. I'm probably not going to be the CEO of a major corporation, right? Probably not even going to be the CSO or the CIO, because I love digital identity so much. I want to focus on that.
I want to talk about that. I want to have a podcast on that and nobody. Will listen to. That, but that's what makes me happy. Right. Right. And I feel good about what I do. And I I'm able to get up in the morning and have energy for work. But and here's the third thing, this is not a career thing, but this is the life thing. Is even though we talked about like okay, you have to be able to have this time to think. You're also at some point need to shut off.
I had a friend his his sage advice was everybody's got to waste some time. Maybe it's you know the the video games or whatever it is, but you you've got to have more interest than work and maybe everybody knows this. But if you're in that mode where it's like you work all day and then you plan your weekends around how you're going to get all your work done. Then your life's not going to be something you really look back on and you're like, yeah, I
actually did something. You've got to have some some time. So you're building a a life. Anyway, I'll stop. There. No, I I absolutely agree. I have. I have three young kids and they definitely help keep me grounded. I've been lately been playing through the new Legend of Zelda game and my middle kid, they're ten years old. And they will just sit on the couch with me while I'm playing it and be like, oh dad, let's go that, oh, we need to go get this thing.
And and like, they're not actually playing the game, but they are so engaged with it that that's like, you know, that's something that like it'll be getting towards the end of the day and I'll, you know, come up upstairs from my Home Office and they'll be like Zelda. And and it's just like, all right, give me 5 minutes to go deploy this thing and then yeah, then we'll then we'll go play and then 10 minutes later get a knock on my door. Dad, Zelda.
And you know, it's it is absolutely important to be able to to do that kind of thing. 100% agree. It's definitely not a waste of time. We might think other people might say you're wasting your time, but it's actually well used time. Absolutely. And it all, it all comes down to how you measure value, right? What? What value are you getting out of the time? And all of your time shouldn't just go to creating value for somebody else's company. Boom mic drop.
There it is. I no this I do not want to drop this microphone. I'm. Sorry, no, that's a very nice microphone. All right, let's get back a little bit on track because I love that conversation. But I do want to get a little bit more about some of the stuff you worked on and as a. Multitalented individual right? An identity. And Speaking of articulation, you've written a book in this area. It's called Oauth 2IN Action.
It always fascinates me when someone can put pen to paper and actually have the, I don't know the the work ethic or whatever it is, sit down and write any set of book. But what was the impetus for creating that? And I guess for people who want to check it out, give me like the 32nd, like back cover synopsis for it because we'll have a we'll have a link in our show notes for this as well. Man. So yeah, the book creating it was was sort of an interesting story.
I was actually approached by my coauthor, Antonio Sanso, who wanted to write this book, didn't want to do it himself. He's a security researcher at the time, he was with Adobe and he's working on Ethereum now or something like that. And but really, really, really smart guy, really smart security
engineer. But he approached me like, you know, hey, there's there's kind of a hole in the market for a book about Oauth that actually takes things from start to finish and explains all of the different parts of it and why they work that way. And and I kind of at that point, I kind of looked around and I was just like he was, he was absolutely right. You know, the, the books that were out there were how to build an Oauth client that connects to GitHub, how to log in with Google.
How to use the Facebook API. All of those were books that would teach you parts of Oauth but weren't teaching you Oauth for its own sake. And that's what we set out to do. So going through the reader learns, learns how to build a, you know, because I'm, I'm an engineer, I build things, you know, it's not real unless I'm building it. And so going through the book, you build an authorization server, you build a couple of different flavors of client, you build a resource server.
And you connect them all together and they're all actually standards compliant, That we do have a banner in the book that says do not use any of this in a production system, please. And I have mostly held to my own advice on that. That's another story though, but we wanted people to be able to. Sit down, and even if you know in their day job, they're only using one tiny little bit of it, like they're just writing a client or they're just
protecting an API. We wanted them to be able to know what all of the other moving parts were that were that were out there and why they were moving that way. Like, why do I have to do all these redirects and all of these backchannel calls and all of this other stuff? Why do I have to deal with authorization codes and Pixie
and all of this other craziness? Because the danger is always somebody looking at a protocol like Oauth and seeing all of the moving pieces and going, you know what, that's really messed up. I can come up with something that is just as secure and way easier to build. And the truth is that it's like you can't. You know you're you're going to come up with something. It might be really, really clever, but it won't have had the kind of scrutiny that an international standard like this
has and all of those. Bits and pieces are there for a reason. Is it always the best reason? No. But there is a reason behind it. And So what we wanted to do with this book was to bring people through everything that was there and sort of show them what the reasons were, that things worked the way that they the way that they did. So if I don't know anything about a lot too, can I put pick this book up and and have a an appreciation for it? Or is there some prerequisite
knowledge that I need? No, I think you can. You can basically come in cold. We tried to, we tried to write it to an audience of people who had either heard of Oauth or we're told that they are using Oauth and needed to needed to start making sense of it. It used to be the case that the publisher put the first two chapters online for free. And honestly, I would say go go read those two and to give you an idea of how how the protocol sort of fundamentally works the
way that it does. I do like the cover of like a pirate or I'm not sure what that's supposed to be. It's like he must be here or something. He is a. Croatian Rifleman, so this is part of the. Part of the branding of that particular series of books from this publisher is that they get very localized period costumes for people.
And when Antonio and I were looking at the different options that they were presenting us with, well, the first one that we picked was this amazing illustration of this guy in LIKE. Full chainmail armor with like a 4 1/2 foot sword out in front of them and we're like, yes, yes, that that's that's going, but apparently apparently the like the head publisher came back with no, that's the wrong historical period for this security book and we're like, we
don't know why what. Does it even mean I? Know exactly. So we we went with a second option which was this guy and he's. A Rifleman from a village in Croatia. I'd have to, I'd have to go back through my archives to to get the information of where. But yeah, that was, that was apparently the sort of the the local dress for like you know the militia and guardsmen and and stuff like that at the time. I like it. I dig it. Check it out in our show notes. And the mustache.
But it is, and like the bandana anyway. The the next thing I want to ask about is Cards Against Identity, which is probably the opposite of serious Oauth 2 talk, but has taken the Identity Identity industry by storm I would say. A very small storm, but yeah. What is Cards Against Identity? Well, I'm sure a lot of your listeners will be familiar with the game Cards Against Humanity. It is a party game that. Really kind of came to prominence about a decade ago, I
think at this point. And the the conceit of the game is that one person basically lays out a prompt and everybody else that's playing provides an answer to fulfill that prompt. And it became famous because it took that basic game mechanic and just made it really raunchy and funny and just. It's with the right group of people. It is absolutely hilarious. Raunchy is not even approaching the level of. That's. Hilarious filth that is part of this.
I have played some some third party expansion decks that make this one look almost kid safe. Try explaining to your stepmother what certain things are. In the middle of the game. I absolutely have a story about that, but I don't think it is appropriate for this podcast, so maybe I'll catch you guys. After right of that game, absolutely. Regardless, that's Cards Against
Humanity, the base game. And so one of the things that they do with copies of this game is that they will send you a bunch of blank cards so that you can basically put in your own house rules and things like that. And there was a group of people that were floating around the. You know the identity conference circuit that had started to collect a bunch of these house cards that had identity themed
jokes on them. And so one of the answer cards was the entire, the entire WS Star documentation, which is a horrifying, you know, answer to anybody who's ever had to touch WS Star and so. I got invited to one of these card games at the Cloud Identity Summit way back in the day, the predecessor to Identiverse, and it was an absolutely hilarious game or like people were dying laughing.
It was it was amazing to just be in a room with all of these brilliant identity nerds making horrible, horrible jokes with each other and and it was a great time. So Fast forward a few years. And I was actually working on publishing a board game I had run a I think at that point I had just started to set up a Kickstarter for it was going to launch it. That game is called Gridlock Boston and it's you can find it under the bespoke website or I'm sure we can drop a link in the info bar too.
But as I was working on prototyping that game I realized that the. Small publisher that I was using could just print cards. And then I had the idea one day, like I could make Cards Against Identity an actual real deck. And so I got out my draftsman's ruler and, you know, tried to calculate the font pitch and the spacing from the margins and all of this other stuff to get cards that could match as closely as I could get them to the base Cards Against Humanity game.
And then I. I came up with a bunch of cards, some of which were from that house deck that I remembered, like the WS Star documentation is in there in the initial deck, and then added a bunch more of my own that I thought was hilarious. Like one of Ian Glazer socks is one of the favorite ones from the first year and really just tried to try to just have a lot of fun with it.
And to me it was going to be just this is a oneoff project, this is ridiculous and we're just going to we're going to do that and. Whatever I brought it to, I think it might have been identifiers at that point. And somebody who lived in the area was actually having a a party the day before, a house party the day before the conference started. So I was there with my box of cards, and I sold out my box of cards that I had printed at that
house party. Now I'd only printed like, I want to say like 30 copies or something like that, 20 or 30 copies. And so, you know, it wasn't that many, but I was just like, wait, people actually want that? I figured I would just be like, shuffling this around to A to like a couple of my friends and I'd be going home with half of this box. But yeah, no, it it it sold out before the conference started. And I realized like there, there might be something interesting here.
And so almost every year since then, I've tried to. You know put together a new deck that I release each year and with jokes that I find interesting and topical. Some people will write to me with an idea or you know I I get Dms on the ID Pro Slack every now and again of like hey, this would be a great card for next year and try to try to work them in when when they make sense and. Yeah, I've been I've there have been 4 editions. Now I'm planning on doing another one next year and it's
it's it's a blast. My favorite experience with the game though has to be at the Oauth Security Workshop last year because I brought at that point the three decks that have been published of Cards Against Identity and somebody brought their base game of Cards Against Humanity, which allows you some wonderful combinations, like you know the question card of why is mommy crying? And you can answer that with SAML, right? It just amazing bits like that.
And so here, here we were, a bunch of drunken security engineers playing this game and just falling over, laughing at ourselves because it was just so absurd, so funny, and probably one of the best times I've ever had at a conference. It was, it was a great time. I can't believe I'm going to do this, but I'm going to waste one of my questions. Definitely lets me ask so many questions per episode, but I'm going to ask what is WS Star for people who didn't live through that? Oh my gosh.
So imagine that you're trying to solve security by writing documents that only can be read by automatically generated document readers. So you actually have to write code that writes the code that reads the code that your code wrote. And in a nutshell, that's that is security based on WS Star. It's the web security family of standards and there's a lot of great concepts in there that
live on today. Oauth in a lot of ways is is a, you know an actual functional and usable version of some of the delegation patterns in WS Star. You know and Sam will take some of the the. Assertion patterns and stuff from WS STAR, but WS STAR itself is just one of those things that is like so complex. End to end. It is, it is nearly inscrutable. And so with with the joke card being the WS STAR documentation, it's it's a terrifying thing to ever be handed to read.
So I know that you are a musician. A game designer? An author? A security and standards architect? So what's the common thread there? I get interested in a lot of things and I've been very lucky to be able to pursue a bunch of those. A lot of the common thread though, I think is these are things that that encourage a creative approach and like we were talking about earlier, I believe with. You know, architecture, security, architecture really kind of takes a takes a creative mindset.
You know that that ability to contemplate that ability to think of how things might go wrong or might go right and what does that mean in that context? You really need to be able to to create those worlds in your head and also share those worlds with the other people that you were working with. And that takes a certain amount of creativity. The other thing that they have common is that they all work
within constraints. So you know, a book has like a technical book, especially you've got chapters and indices and examples and things like that music, you've got scales and modes and forms and timbre and all of this other stuff. Game design is literally all just math and spreadsheets under the hood, even if if you don't realize it. Like writing a board game is sitting down and doing a lot of weird math to make sure that nobody playing your game feels
like they're doing weird math. So it's kind of like the creative side of like, I wanna create this cool thing and I say, wait, how do I create it exactly? And then figuring that out. Within the constraints of the system that you're applying it to, yeah, absolutely. That makes a lot of sense to me, so I wrote this next question last night. Now, it kind of sounds a little weird, but I'm going to ask you or state it anyway. Have you have you seen the movie The Godfather?
Yes. And I guess who has, right. So I was going to say you're kind of like the Don Corleone of or Corleone of Open ID Connect and. Well, well, so OK, like I said. I'm curious to see where you're going with this one. So then I thought of this earlier today was do you remember the scene where Luca Bravi, Luca Brazi sits down with Don Corleone and he's very nervous. He's almost like reading from a piece of paper. Don Corleone.
You. Came up with many good standards for the Open ID Connect standard. Don Corleone, you've written many good aspects to the Oauth 2 standard, and so where I was going with it was this is terrible. I wonder where this is going myself. So This is why the pitch count. If you wouldn't edit it right to this part, it would be Don Corleone. If Open ID Connect was being written anew today, how would it be different? That is a great question. Because right there.
Well, no, I'm, I'm going to be honest, I'm struggling to see where The Godfather fits in with her, even though I did have a Godfather quote in the in the last presentation I gave at Idanaverse this year. The whole, you know what happens when standards meet the real world? It's like look at how they massacred my boy. But yeah, I I will say starting off, I, you know, I was part of a large group of very smart people who worked on all of
these things. I was very lucky to be in the right community at the right time to be able to work on this stuff. And you know, I'm, I'm far from the only voice and lost a lot of arguments in in all of that spaces. So that said, I think that if we were building Open ID Connect in Oauth today, it would definitely look different because it does look different today than it did a decade to a decade and a half ago when we started.
There are features that have been sort of grafted in to both of these protocols that weren't there before. So there's a pattern that's now becoming more well known called intent registration. And intent registration basically allows the client software to say this is what I'm about to do and do that, do that bit in a secure way so that when you then go and step and start talking to the users, then you can actually sort of deal with all of that sort of squishy user
space. Without having to worry about somebody mucking up that initial request of this is what I'm about to do. In the Oauth world, that and Open ID Connect to that is implemented with something called a pushed authorization request. If we were building these systems today, I honestly think that we would just always use that and that and that is that is in fact the advice of the Fappy Working Group. A high security profile of Oauth and Open ID Connect is to always
use that. Because there's a lot of benefits from doing intent registration and asking that question of like what would it look like if we built a system today That was a lot, a lot of the engineering behind GNAP, the grant negotiation and authorization protocol, which is in i.e. SG review in the ITF standards body, which means it's it's close to done. And what we tried to do with that project was take a step
back and say like, okay. Regardless of how how you do things in Oauth, what are the best practices and best patterns and things, and can we actually make this all kind of fit together? So another thing in the Oauth world is that when you're calling an API, you have a set of scopes. Those scopes limit what the resulting tokens can do. And it was brilliant innovation for 2010. Because previous to that it was either you get the whole API or you don't, right?
So scopes absolutely brilliant and work great. Well today we've now got an extra decade of delegated API access and people are realizing, like, I want this token to be able to spend $5 within the next month, but not more than that and at least $0.50 at a time. And being able to like really, really dial in that kind of stuff and be able to ask for that kind of thing and associate those kind of rights with these
access tokens. And so in GNAP, we came up with a structure that allowed us to express that. And then I actually worked with a couple of other folks, Brian Campbell and Torsten Loterstadt. To back port that to Oauth 2 and that recently became an RFC of rich authorization requests. And so in addition to scopes in Oauth, you can now say like these are the actions I want to take at this location with these
data types. And actually also just you know, customize that to whatever API it is that you're protecting and
so you can say things like. You know, I I need to do this amount of, you know, this amount at this time or or whatever you need to do. And I think we would have that kind of stuff just baked in from the beginning because we've learned more of sort of how this stuff gets used and and how people want to use it. I think that everything you just said there was, it's like, those are so many amazing concepts and
I also think like, okay. You push out a standard or you're working on a standard, it gets published. What if it doesn't get adopted? Does that indicate whether or not you were successful? Or are there other measures of success of publishing a standard? There are a lot of ways to measure success, and some of the, you know, some of the best things that a standard can end up doing is being an organ donor for something else.
You know, you get a concept and it might be brilliant and it might work right, but it might not be packaged in quite the way that people can actually use. Going back to WS Star that, you know, we were making fun of a bit earlier today, there were a lot of good concepts in that and being able to sort of talk about security in a in a systematic way was. Not exactly new, but the way that it was done was was kind of new. It was just an absolute disaster
to actually use. So a lot of people would say that, you know, because of that WS Star is a is a failed security system and by that measure it would be but and a lot of people have scars from that too. You know, by that measure it's also, you know, not successful. But The thing is we wouldn't be where we were today without that as a stepping stone. I don't think you know because we we have to learn these lessons somewhere. And so the ITF famously says that, you know, I TF doesn't
pick market winners. You know it's it's not, it's not out there to to steer competition in One Direction or another. It's out there to create the best technical standards that there are. And if there is a market niche that that fits things, then
that's great. If there's not, then you know the documents are there and their archive, they they may take life, they may take on life much later in a different space in a different way, or they may get sort of picked up, sliced apart and used in something else that you didn't anticipate. So I I think this could be a good segue into a listener question. So Mike Woodburn submitted the question. What are your thoughts on the current and future state of Uma? Are you seeing it being used?
Does the current incarnation of Uma have legs, or is there a need for UMA 2.0? So I was an editor on UMA 2.0, so that already exists for like 5 or 6 years. So modifying that to UMA 3.0. I would say that UMA was one of those things that it really pushed the conversation especially about user to user delegation and how we represent that in in systems. And it really pushed a lot of the concepts and ideas forward in ways that were not being
talked about elsewhere. It was packaged sort of together in such a way that was really hard to apply in a lot of spaces And so I would say by. By that measure, you know there are deployments of UMA, but they don't have the type of, you know, world reaching, cold boot capable distributed authorization promise that UMA is technologically capable of.
That said though a lot of the design tenants of UMA went into GNAP, a lot of the design tenants of UMA are being sort of picked up in. Different ways in different different systems. So you know something that's that kind of branched out from UMA is the ability to, you know, very dynamically connect a resource server and
authorization server. We're seeing some of that in in some of these, you know, more tightly coupled, more tightly regulated systems out there, not using UMA, not using quite all of that. Same tooling, but pulling a lot of the concepts in sort of new and different ways that that UMA introduced and did well with it but just didn't, didn't land in quite the same market kind of way.
So I want to do 2 more listener questions because I think it's it's fantastic when listener send questions our way and please if you're listening and you've got some questions. Send them over. This one was specifically you for you from Mike. Again, it was. I'm not sure what he was driving at, but I'm sure he had something on it. What's your favorite star back, I guess like our back about? Our back back things like that, so. Please say baby, baby got. That's that's that's a great one.
But I I actually have two answers to this. The first, the first, the more serious answer is is attribute based. Because I think fundamentally you can model all of these other systems using attributes. The problem of course is that attributes then have their own attributes and you get into attribute provenance. And how do I trust this attribute source and all of this
other stuff and. It very, very, very quickly spirals out of control to the point where somebody says, you know what, screw it, just give me a roll, just just give me tell me which of these attributes is roll and I'll just, I'll just go from that. And so I love the promise of the system. In practice it's it's a little harder to deal with. I think some of the dynamic policy engines and policy languages that we're seeing happen today, you know it's going to help with that a lot.
But you know, it's we've still got a long ways to go to make that really, really, you know, usable. I'm a fan of attribute based access control only as a starting point because I feel like a lot of companies, they're like, yeah you want to be role based and then they actually get into it a little bit and like wow, this is a lot harder than I thought it would be. And I feel like at least with the attribute you can get a kickstart and say okay well.
Can you answer a basic question? Are you an employee or you're not an employee? Do you work in this location or somewhere else? Right. Those sorts of things as kind of a starting block only because I think it's easier to start there, but mileage may vary. Obviously the consulting answer is it depends. Absolutely. And you know, a lot of that comes with the sort of the nature of these computing systems and computing security systems. They're they're good at computing against these discrete
models. Where if value is this or greater than this, then answer is yes. Which gets me to my true favorite, you know star back type system and that is CRBAC, the Cinnamon Roll Based Access Control. So there's a there's an old onion article from I think 2014. Where somebody just has this picture of this honestly rather mediocre looking cinnamon roll and they they are saying that oh, it is just too good. It is too perfect for this world, too pure.
And it's it's this hilarious little bit of writing comedy that got picked up and sort of run with by the Internet at large. And the sort of the epithet of cinnamon roll is now being applied to people who are too good, too pure for this world. Like you're you're a good person. You're just you are a precious cinnamon roll. And so because of that, there that came to be, you know a bit of a joke in security circles that you know what, Why couldn't we have something that you know
that the system. Like it. It knows that, oh, you're a precious cinnamon roll. Of course we'll let you in. And even though that it, you know, it is on the surface, it is a joke. That's how the real world works. Like, I couldn't tell you how many times I've been able to just like, you know, somebody just like gave me their employee discount because like we were chatting and they're like, yeah, I'll, I'll take the 5% off.
You know, don't worry about it. And, you know, just nice little things of people being people to each other. Because we have the ability to kind of deal in that squishy space. I honestly think computers and computer security are going to have to address that space because that's how we model things in the real world.
There's a whole thing in identity proofing, saying that, like, we need to move away from asking people what their birthday is, because all I need to know is if you're old enough to drink, right? But The thing is like. So. So I should be able to hand the bartender something and they check that yes, is old enough to drink. That's tested and verifiable, and we're good. Oh, that's great and all except that in the real world, you don't always get carded all the
time. You don't get carded every time that the bartender you go back up to order a drink. If the bartender recognizes you or you fit the expectations of you're probably supposed to be here doing this thing then. You're probably not going to get checked. This is effectively Cinnamon rollbased Access Control. They're like you're somebody I don't have to worry about. I'm not going to get in trouble by selling you a drink. I get a good vibe from this and we'll be just fine.
We'll we'll we'll be fine. And you know, this can slew on one side or another of the should this have actually gone through according to the formal rules of the system. You know, and this is, this is a space where I think that a lot of a I based modeling is going to open some really interesting doors, some terrifying doors, because suddenly we have a potentially nondeterministic security system.
But we're already getting into that space with all of these risk engines that have all of these inputs that like nobody has all of that in their head at any given point. Like, nobody can tell me how Azure actually figures out when to prompt you for a password. Like, I guarantee you ask anybody on the Azure team and they're just like, there's the
risk engine has it in there. There's I can show you all the inputs, I can show you the math, but like, nobody's sitting there doing all of that because that's what the computer is there for. That's what kind of scares me about AI overall. I mean, if you had some major financial crime take place. You know, I broke into a bank and I was able to transfer $10 million and I never got prompted. And it's like, well, the system determined you didn't need to be
prompted. That's not a good enough answer. Well, The thing is like you go into a bank and ask to ask to withdraw $10 million as a person. That request on its own is going to raise the risk and that's where these systems I think can really start to be smarter about it. You know, it's because the banker is sitting there going like, this feels kind of funny. Like, so I do all of my banking with a local bank here since since you brought up banking with the example.
And the last time I had to go in to get a cashier's check for something, they were, they didn't ask for my ID like the bank manager. The bank manager knows me. She's just like, Oh yeah, how much do you want this check made out for? Yep. OK, you know, X number, $1000. Here you go. Have a good day. And she was just like Yep, no problem. It's in your account. I know who you are. This is fine. Which bank is that and where is that?
At right, exactly. And. And so The thing is like, yeah, if you could convince Maria, the bank manager, that you're me, you deserve that money. Honestly, go for it. There's not a lot in. There I'm trying. Not a great example. I'm sure we come up with other examples. I just kind of feel like. If we're going to have algorithms in a I, some human being should be able to explain
them. So in other words, like hey, what if I looked at your health insurance records or something and I didn't get, I didn't get prompted or something like that. So there is a scenario where maybe it does not fit that risk engine trigger. And and that's that is interestingly another space where I think that some of the recent developments in natural language AI are really going to
come into come into play. Being able to query a system and say that like hey, you've got this policy, explain it to me, what is this doing? Why did you make that decision? So if somebody went and asked the bank manager like, hey, why did you just write that check? You know, if the if the regional manager had been in that day and they were just like, wait, why? Why didn't you ask for his license? Like why? Why did you just write that check? The manager could be like he's
been banking here for 15 years. We know him. It's fine. You know, he used to live like walking distance from from the bank. Like you know, we we know this guy. Don't worry about it. It's totally fine. Just just watch and and being able to explain that is something that the human that made the decision does.
Right now we're at the precipice of having systems that make these decisions that they can't explain themselves and we're not requiring them to explain themselves Because in you know, in that scenario if the regional manager was just like, yeah, no, never do that again For these reasons. You can change behavior and even if nothing bad had happened from that incident, that can be a learning experience for that.
And then the next time that kind of thing happens, the bank manager could tell me like, Oh yeah, sorry, we need to ask for your ID because of, you know, such and such regulation or whatever. And it is, it's, you know, it's now policy that I have to enforce this. Yeah, sorry. I know it's annoying.
She can explain it to me. As much as she can explain, she can explain the change of policy to me and the change of behavior to me. Right now we've got systems, whether they, they're AI driven or not, are doing absolutely inscrutable things to users and just firing off results and expecting people to deal with them. We have no insight into the underlying models that are, you know, moving us about the Internet on a daytoday basis. And I would like more insight into that.
Personally, I I think that there's a lot of room for that type of thing. So one can even imagine a space. And I had a conversation with a with a colleague about this at a recent conference. One can even imagine a space where I implement a set of policy system a a set of policies in my system by just explaining to it what I want to get done and it will go and translate that to whatever policy language that I that I have. And execute that in the system. And then I say okay.
Explain to me what you just did independently of what I put in. Explain to me what that is. And I can read that be like okay, that makes sense. And then I can take that explanation over to another system with a different policy language and say here's what we want. Like this is what I want out of this system and go through the same process. And the underlying formal language and modeling can be completely different in both
cases. And we've got this sort of buffer of human language in between all of them. We're nowhere near there yet, but we're getting close to that in very, very interesting ways. All right, we got one more question. This is from another listener. This is from Marcus, who reached out to me. He shared this story and I figure this is a good one to get 3 identity consultants to weigh in on. So here we go. So I'm going to paraphrase it. So. Basically joined a company
recently. They're implementing automation was more of a political issue than a technical one. And the root of this is basically trust for HR. It sounds like to me there were issues with data quality from an HR perspective and so automating it joiners, movers, levers, right, that kind of thing based off of that suspect data.
People didn't really want to do and he and I think he's he's had some prior experience of this where you know like an HR feed failed and you know people got terminated incorrectly, right. Every once in a while you hear this kind of those horror stories right around identity management gone wrong. That's probably a book right there and they put extra text you know extra checks and stuff like that in there.
And it's actually you know it was on a conversation earlier today where there was a very similar issue the the HR. Data quality and I, and probably it's not H R's fault per se, but the data quality and the authoritative source wasn't good enough, it was causing problems. So it boils down to do you trust HR to basically keep their data clean? Because if you're going to automate, you need cleaning to start with, otherwise you get automated garbage at the end.
And so I thought it was kind of an interesting topic to kind of say, well, you know, how does an IT team. And I am person whoever's in here go off and say, okay, well, we know a suspect data is coming out of HR. How do we address that in a way that doesn't alienate us from our friends over at HR, You know, diplomatic way. What are the right thing is because I think a lot of organizations struggle with this fact of look, this is just what we've been given and we just got to work with it.
I don't know, man, I don't buy it. I mean sometimes it's it's you have to keep knocking on the door and raising the arms like, look, this is a problem. This is a problem. I'm curious to hear both your guys's thoughts and Justin, we can start with you as the guest of honor. You know, this concept of trusting HR, trusting X with data quality. You know, where do you start with a conversation like that? So imagine you have a river. That river is your water source.
You're depending on this right now because you were told that this is the water source that you're depending on, and you pull water from that source and it's polluted. It might sometimes be more, might sometimes be less, but there's a problem with it. So then the question that you're asking is akin to all right, how do I? How do I deal with that polluted water source? And the answer is really similar in data streams as it is in physical streams. You can.
Address pollution at the source. You can filter it as you go out and sort of clean it up as best you can. You can augment it or replace it with a separate water source, right? You can drill a well instead of pulling from the river and hope that that's, you know, less polluted. The real answer is to do all of those you know. If HR is giving you garbage data, go help HR stop giving you garbage data. Like if you're on the IT and Identity team like they should
not like that system. If it's not directly in your in your purview, you should at least have a hand in saying what goes on with it, what goes into it, what comes out of it, how you use it, you know and how it's managed. And so bring that to the table being like you know we need this to be cleaner. And it will help you if this is also cleaner. But that's not good enough really. You cannot expect pristine data
anywhere. So yeah, still have the filtering on the way out, still augment it with locally collected attributes or roles or caches or any number of things. That allow you to deal with this because you know that an external source is not always going to be 100% reliable, but you in cases like this you really, I honestly think you have to try to fight to help make that source as reliable as possible. So clean up the river, get better filters and drill a well. Problem solved.
No problem not solved at all. It is an ongoing journey. No, we got, we got the water. It's perfect. We're good to go. Yeah, I mean, so you know, with the question Marcus said that is more of a political issue. So I don't really know exactly what that means is like if that HR doesn't care, you know, they're not willing to do things to address it. They don't have a communication path. I think if if it's not those
things like. You know, if you can sit down with the folks and try to address the issues because they don't know how serious the issues are, but when it you talk about people being terminated in the incorrect time frame, then I'd say is definitely something major, right? Something major is happening like this data is really bad. Not just people's names are being misspelled or things like
that. I was thinking about some kind of layer of abstraction, which I've seen a lot of clients do, where they create some kind of table. And database where they're precleaning the data prior to moving it into their identity management system. So that could potentially be the answer.
But you know the, the political side, I think, I think kind of to Justin's point, even if you do it a layer of abstraction or either even if you do say the HR system just can't, can't fit our needs, maybe the company has 40HR systems, right? Maybe that's what the problem is. Maybe some of them are good and some of them are not good and you just have to like figure out how do we exist in this environment where the data is a total mess.
But I do think you need to work on all these things, especially that political angle like if you have a broken down communication process or somehow like that team just doesn't care about your needs, that's dysfunctional for the organization and it's resulting in the organization's suffering so. You have to do something to fix that and in the meantime try to do the patchwork and you know, to make sure that you don't have
outages. Because I do think kind of stepping away from HR data holistically is not the right solution. But you know, in that 40HR system scenario, what I've seen is like okay, you might have this HR system and I don't want to pick on any particular country, let's say it's like really far from wherever your home corporate office is. And they just do things so much differently. They only update the HR system once a month or it's offloaded to some kind of third party.
They won't give you extracts, things like that. So you know, it might be that kind of scenario that just can't easily be fixed. And when it gets fixed is when the whole company moves over to, you know, work day to pick the HR system du jour. So yeah, fix your fix your governance process, relationship process, whatever, and then do a multitier technical approach. I poked fun a little bit Justin saying problem solved because I like. I really liked your answer. It was a great analogy.
I think people will really under will hopefully understand that it is a layered effect, right. It's it's almost like you're filtering the filter right? You're going to throw these different levels of of cleaning. To try and make sure you remove as many you know defects as possible from the process. Will it ever be 100%? Maybe not, but 50% is better than nothing and 75% is better than 50%. So it is a journey as you go along. So absolutely weighed in on that.
I mean, how many people are on municipal water in their houses that is perfectly safe to drink but still use Brita filters or you know, a refrigerator with a water filter? I know, I do. And. You know, I can absolutely drink the water out of the tap here. It's totally fine. I have no reason to, you know, be concerned about it. But it's kind of set up so that it's actually easier to get a cup of, you know, cold water by going to the refrigerator, which has this extra filter in it.
And maybe it tastes a little different, maybe it doesn't. I don't know if I would actually pass a blind test on that, but. You know, at the end of the day, the result is like. That's what I go to because that's what works. It feels good, looks good, it tastes good, whatever it may be. And sometimes that's all it takes, right? Exactly. Yeah. You need to navigate your identity systems by taste. That should be really the biggest take away from today's
episode. So Becky or Enrique, if you guys are listening, I'd love to see another dimension added to the the. Identity rankings for you know mouth feel almost like a fine wine, right? Like you know what does this would have legs, you know what's the coloring look like? Is it full bodied when it comes to identity? System viscous is for draw.
There you go. All right, let's start to wrap things up. Because this, you remember how we talked about, wow, there's no way we spent an hour and a half. Well, we're already at like an hour and 15, so let's wrap things up. You mentioned musician and I want to talk about this band called Cyclic. Tell me about the band cyclic. So first I will caveat to say that when you're 19 and an idiot, you should not be allowed to pick your band name and I really should have moved away
from that at some point. But so Cyclic is the name of a musical project that I started on my own and have been doing stuff on and off for gosh, almost 20 years now, 1520 years in one fashion or another. And I I grew up around music. I've been playing piano since I was like 6 or 7 years old, did classical lessons for a long time, selftaught on guitar and you know, synthesizers and all of the the things that I play now. And I also, you know, I just come from a really musical family.
You know, my, my grandmother had a, you know, regionally known. Band that like my dad and uncle played in and and all of all of that kind of stuff. I always grew up around music and so I just, you know, kind of just always kept doing that. And these days I've been really lucky that, you know, to live in a time where self-publishing, self recording and self-publishing stuff is within reach of kind of like average working people, you know, to be able to get decent quality.
Audio out of a system doesn't take a huge investment and I've got a decent studio set up now, but that's because you know, I'm I'm approaching my mid 40s. I've collected little bits and pieces over the years to like, you know, as as I've been able to, but I mean this whole time, you know, I could a lot of what I do, I could do it probably not as easily but I could still do it on. Just a little dinky laptop and a tiny little USB interface and come out all right.
And so anyway, I've just, I've always been around music, I've always had it in me, and I enjoy the process of creating and sculpting from sort of. The textures of the sounds and sort of the stories that you can tell with the music itself. A lot of what I write is instrumental. I do have some non instrumental, you know, some vocal tracks here
and there. Most of what I do is instrumental and I really like being able to kind of bring someone on a journey without telling them what that journey is. You know, I want to show you, I don't want to necessarily tell you. And that's that's what I've always really loved about it. And you know for the last five years or so I've I've let other things kind of get in the way of of the music side of things. I've done little bits here and there.
I, you know contributed to a couple of indie film scores, little little bits here and there. But I am finally I I've made it a sort of a personal resolution to actually get back into proper composition and recording and and actually trying to get something new out. Maybe this year, I don't know. I'm, I'm not going to commit to that on on a on an international podcast here.
But you know, one one can hope that I'll be able to do that because I love doing it and you know, I just, I love the creative process and I love the creativity that comes with the constraints of sort of these music systems because not everything sounds good, not everything sounds pleasing. So how do you work with that? It always fascinates me because I love music, but I am not a musician. I cannot figure out for the life of me how you would even start
to create anything like that. I, you know, I listen to a bunch of your stuff actually, when we first heard about it, and I think it's great. I don't think it's really diverse. I mean, there's two songs that I kind of want to point out there. There's one called Snow Runner, and this is my this is my amateur take on it, right?
It's a very fastpaced. And I kind of mentioned before we hit record here, it's like it reminded me of something that I would hear playing in the game wipe out, which is like this futuristic racer on PlayStation from days of old. And I love it. Like that's that's my jam, totally. So funny anecdote about that song. I originally wrote that as an accompaniment bit to a video game, and that was that we did
in grad school. So we had a point in point in this little, you know, graduate class video game where somebody basically gets a speed boost and takes off. And I'm just like I I want more than just like oh, it goes and does a thing. And so I, I went home and wrote the Rift to that and recorded it in like an hour and like sent the MP3 to my to my teammates. And it was just like just just played, you know call MP3 dot play when when that event fires.
And and that was. That was the origin of that song. I eventually went and made it into a full song, but but that's that's where that originally came from. Okay. So I'm not totally crazy because it really did. It conveys like a sense of speed is the way when I was listening to it, the other one that I really liked was called Incognito Shuffle, which I don't know if it could be any more different than that other one because it's it's it gives me kind of like this vibe of like a Speakeasy.
It's a lounge. It's kind of like a very cool. Jazzy type of vibe to it. I thought it was great. Yeah, like my my music tastes are really pretty diverse. I'm I'm really all over the map and in the stuff that I write, you know, there's there's a lot of electronic rock kind of at the surface. But honestly, I've got a ton of like, jazz and Blues influence in what I write. And so sometimes it really, really comes to the forefront, like an Incognito shuffle. Like deliberately.
Like I'm going to strip out everything except like and just just do this. Can I actually write that right. Like that was that was the constraint. It's like can I do just this style of of song without adding all the piles of synthesizers and guitars and all of the other stuff that I usually hide behind. And other times it's like no bring bring the wall of noise. Bring everything in do all of this all together and.
But yeah, a lot of the different stuff that I listen to and I've been exposed to shows up in the stuff that I write. And you know, that's I I think that that's true with most of my life. Like, you know, just all of these different things that I've done as, you know, Jim Jim was talking about before, all these different things that I've gotten involved in. Like to me they're all, they're all just like connected by like that is interesting and I have
an opportunity. But there's a lot of commonality that does actually thread underneath them. So I'm going to try and play a song after this show ends. It's probably going to be a Spotify exclusive because it's sort of built into that platform. So if you're not listening on Spotify, you probably won't hear it. But definitely check it out. I don't have a link in our show notes right to cyclic.com. So you can kind of check out more there.
But it's got, I think the one that you recommended is called Every morning Orange in Blue, Is that right? Tell me about that one. So if people are checking it out, they can kind of get the story behind it as they're listening. So like with a lot of things that I a lot of music that I write it started off with me just playing around and coming up with kind of a a feel for a
riff that I that I liked. And I was just like where where can I go with this You know what kind of sounds can I can I work with this and the title of this. Like a lot of the titles in my songs are just kind of like that's what the music is kind of telling me that this is the story that's here. Like I don't necessarily go into write something named that. It's like I start to write something and it's like, oh, this is, this is what this is named.
But to me the in that particular song, the energy that it kind of, you know, starts out with and just kind of dives through the whole, the whole thing. To me it's it's always felt like, you know, you're getting up at sunrise and you're training for some, you know, big athletic thing like this is you getting up and just going. Like whatever you're whatever you're trying to tackle, whatever you're trying to get to, you are getting up and going and getting out there in the
world. And you know, sometimes it's smoother, sometimes it's more chaotic. But you're you're moving forward, you never stop moving forward, even when even when it seems like things might be a little bit slower. So to me that's that's always been the story of that song. So I'm going to try and play it afterwards. It might be a region based thing. I don't know how positive advanced people need to go check it out after fact, but. Digital rights are so strange. They are.
And you know, we've made it this far without a copyright strike or any of that crap. So I'm trying to trying to keep the streak alive, Jim. You know, an hour and 20 some minutes already. We did it. There's our show. That's our show and we started off, you know, before the show saying we've never hit an hour and a half. I'll never hit an hour and a half. Yeah, I'm sure with a little tweaks, I'll probably get down a couple minutes and stuff like that. But yeah, I think we've set the
record. Congratulations, Justin, now the world record holder for longest identity at the Center podcast episode. Well, at least for now, I'm sure you guys will will break that wall soon as sooner than you think. We're gonna go ahead and wrap it up for that one. I have like a laundry list of show notes and links. I've got your LinkedIn profile. Justin got the website for bespoke engineering. While you were talking about the the why applications fail, I
found a link for that as well. The book link Gnap. Sorry gnap. I keep saying gnap. So small anecdote on that. I know we're already pushing the links of the show, but there was actually a big debate in the working group about what the official pronunciation of the working group was. I strongly came down on the side of there is no official pronunciation. Because, like, we can't dictate how people are going to read this text without somebody reading it to them.
So I say nap, I've heard people say G, nap I've heard people say nap. I've with a soft G I've heard all sorts of things. I think they all apply. So yeah, don't. Don't apologize for it being different. All right. So I have, I have a grace period there. What? So I have a link to that. We'll have a link to cards against identity gridlock, Boston, obviously cyclic. And then?
You kind of told the story a little bit earlier during the conversation, but the precious cinnamon roll and so The Onion article that that's sort of like based on as well. So chock full of links. Yeah. So that's that's for people to look at. Yeah, we're going to leave it there. You know, we're on the web, idacpodcast.com. We're on Twitter at IDAC podcast, we're on Mastodon at IDAC podcast at infosec dot exchange.
No, we're not on threads yet. I don't know if you ever will be. Most of our engagement comes on LinkedIn and Twitter and that's probably what we'll stick for now. But definitely you can always connect with Jim and I on LinkedIn. If you've got questions, send them in right. This is our opportunity where we can get smart people, you know, on the line with us and get some real expert opinions of some of those stuff. So hopefully people enjoy that as well. And don't forget about
authenticate. So use our conference code it is. If I could find it here I DAC. 15 podcast, 15% off. Hopefully we'll see a lot of friendly faces there. Hopefully you'll help us figure out what that live show looks like, Jim, when we when we get up on the stage as we kind of go along. But yeah. So Justin, thank you so much for your time. Jim, thanks for your time and we'll go ahead and leave it there. Thanks for listening. We'll talk with everyone in the
next one. You've been listening to Identity at the Center. We hope you've enjoyed the show. Make sure to like, rate and review and we'll be back soon. But in the meantime, hit the website at identity@thecenter.com and find us on Twitter at IDAC Podcast. See you next time on Identity at the Center.