security pioneer // creator of dotenv and @dotenvx
LA & SF
Joined July 2023
- Tweets2.6K
- Following11
- Followers728
- Likes2.8K
My take is mixed feelings on this.
On the one hand I want to get rid of long lived api keys.
On the other hand if I'm the same attacker that got into Vercel's secrets vault just 5 months ago (April)...
I'm looking at this and thinking wow I could mint tomorrow's secrets - not just access old ones. That's POWERFUL as an attacker.
OIDC centralizes trust even more than cloud vaults from every angle I keep looking at it - tell me I'm wrong please. I'm open to be convinced.
But until then the answer is secret sovereignty - where individual devs and agents issue their own keys. The best for that is http signed messages where the API client issues their public key to the API provider and signs their request with their private key. That's the future I'd like to see.
Until then an incredible proxy for that is dotenvx - because it literally proxies your static API key into a public/private keypair.
It's time to retire long-lived static credentials.
We surveyed 1,000+ SaaS vendors and found only 8.4% support secure auth. This is our call to action and how we're doing our part.
vercel.com/blog/death-to-lon…
Is dotenvx too complicated? somehow every single security tool i try is byzantine as fuck or has too many emojis. i never want dotenvx to become that. solid security is for the working man too.
$ dotenvx encrypt
Great - from 2010 - read by @karrisaarinen
Your Product Needs a Soul.
karrisaarinen.com/posts/soul…
Every couple of weeks, someone reaches out to tell me how much they love Dotenvx, followed by: “How have I never heard of this? Is it new?”
Meanwhile, tens of thousands (maybe hundreds of thousands) of developers are quietly using it every week.
Dotenvx has never been the hot thing on tech Twitter. It's grown the old-fashioned way: developers (and now agents) discovering it, using it, and sharing it with other developers.
There's something pretty special about that.
It is tough these days to build secure software - especially if you are under a major attack like OpenCode. So I feel for them and they build great product.
But this is another example of why you should use a model like Dotenvx or SOPS. Split your secrets cryptographically so that an attacker has to attack both the providers secret store (in this case that is what was attacked) AND the encrypted secret in your code (which was not attacked or even reachable here).
This is why we wrote our whitepaper. Meanwhile, every other provider retweeting OpenCode and saying 'use our secrets store' is repeating the same systematic problem - centralizing your secrets to their secrets store yet again.
Dotenvx or solutions like SOPS are the only way to solve this for your organization.
teapaw.org/opencode/status/211151…
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
so bad to be in the middle in these kind of times. either log off or never log out. either embrace agentic or build human only. either raise massive or don't raise at all. these are not the middling times.
The @anomalyco emerging exhibit A on this. It was never about the software.
good music you find meaning in
maybe in the near future, good software, you'll find meaning in. maybe i'm being too sentimental. but maybe that will be the future. i mean music has been basically free to make since the 50s now and software is just getting started.
When radio was born and classic music was broken, music changed - it became songs about love and lost love. Sometimes I wonder these days if software will follow the same path. Less about technical feat, more about emotional reach.
These are the times you look back and say... wow, those were the good times. Most of us are working harder than ever. Days feel like weeks. Ups and downs. More productive than ever yet somehow still feels like not enough. The whole market changing, the whole engineering discipline changing, new winners, new losers. It's a historical time right now, and we're lucky to be riding it. Grab the bar, white knuckle it, and see you all at the end!
