Malte Ubl

Self-driving infrastructure

@Vercel CTO.
Immigrant 🇺🇸/🇩🇪/acc

[Malte Ubl @cramforce]

// I was young and needed to ship.

[Malte Ubl @cramforce]

@kolovskydev This is not what we are seeing. And we're shipping DPoP for the CLI soon

[Malte Ubl @cramforce]

We are rolling out 2fa-confirmation or email-re-login to many sensitive actions, such as reading environment variables, in the Vercel dashboard.

Consider enrolling a passkey today to make that a quick fingerprint sensor thing.

[Malte Ubl @cramforce]

@clhdev For now API tokens default to not require re-confirmation

[Malte Ubl @cramforce]

@zeeg We did, indeed, call is sudo mode!

[Malte Ubl @cramforce]

@dusangran vercel env pull will get fine-grained tokens instead. And we can rollout unstealable tokens (DPoP) to everyone which is not yet possible in browsers (but we are also shipping DBSC to supported browsers)

[Malte Ubl @cramforce]

@divikkk1 @vercel CC @amyegan Is it possible?

[Malte Ubl @cramforce]

@djmicrobeads No, OIDC is so simple it needs nothing like it

[Malte Ubl @cramforce]

I've been cooking on this post for a bit, but with the cyber security events of this week I had to ship it:

Long-live static credentials must die. We never want to rotate API keys again.

Turns out only 8% of cloud and SaaS vendors support secure alternative. This is our call to action to change this AND our commitment to do our part:

- We are requiring vendors on our marketplace to support OIDC
- We shipped @shadcn components to make it easier to ship OIDC configuration
- We are expanding OIDC support on our own platform

The last generation got the web from HTTP to HTTPS. It is on us to move past API keys.
https://t.co/g3r5jk79U8

[Malte Ubl @cramforce]

@oriSomething Lol, good old days

[Malte Ubl @cramforce]

@zeeg @jacobmparis @zeeg stole your idea

[Malte Ubl @cramforce]

@MelkeyDev 🏎️

[Malte Ubl @cramforce]

@oynickj @z0oks @andrewqu "Potentially our first win"

[Malte Ubl @cramforce]

If I did a podcast together with @andrewqu, would you be interested in listening/watching?

[Malte Ubl @cramforce]

@z0oks @oynickj @andrewqu "Our first win"

[Malte Ubl @cramforce]

@CompleteSkeptic @typesafeai Glad you finally took the press training

[Malte Ubl @cramforce]

@ejc3 So, ideally yes, but that makes the implementation even more complex

[Malte Ubl @cramforce]

@dannysullivan @vestaboard I've only been using it through my own app since before vibe coding.

My favorite feature is a countdown to some event (like last day of school or the next vacation)

It's an amazing device.

[Malte Ubl @cramforce]

Most unsurprising finding: AI is great at @vestaboard drawings

[Malte Ubl @cramforce]

@Mahmut_Jomaa It will likely have been the least busy weeks

[Malte Ubl @cramforce]

The recent node.js RCE related to brotli compression is broader than just node.js and applies to essentially all software using brotli[1]

Vercel’s firewall protection against the attack is effective independent of the backend technology.

Python is vulnerable. However, unlike Node.js it requires using the pypi/brotli package explicitly[2].

It is likely that other software is impacted. Attacks can happen both through decoding incoming HTTP requests (which the Vercel Firewall protects against) as well as downloading attacker-controller payloads via HTTP.

[1] https://t.co/t0gPj5IqNf
[2] https://t.co/CMsgUoqAgG

[Vercel Developers @vercel_dev]

Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.

Vercel WAF rules are live for every project and block known exploit patterns.

https://t.co/JtfEshHnOC

[Malte Ubl @cramforce]

@shreyashtwts CC @rough__sea

[Malte Ubl @cramforce]

I think this is threat model: If I have root I can get more root.

Again, we are working on identity federation for deployments. It is not a released feature. It will work like the attached tweet.
Note, how
- The generated token is short-lived
- Can only deploy (not make more keys)

This is the same identity federation model as AWS, GCP, Azure. Feedback welcome
https://t.co/o1FmQ9X35n

[Malte Ubl @cramforce]

@yordisprieto @vercel_dev Not sure I follow your assumption.

This is, how, it works:

- You allow-list your CI OIDC creds on the Vercel side to perform deployments
- You invoke the CLI to exchange your OIDC token against a very short-lived Vercel token that can deploy only
- You call `vercel deploy`