Summary: fly.io wrote two new programs ("some little security thingies") to reduce the attack surface of their codebase.<p>1. "Tokenizer is an HTTP proxy that injects third party authentication credentials into requests. Clients encrypt third party secrets using the proxy's public key. When the client wants to send a request to the third party service, it does so via the proxy, sending along the encrypted secret in the Proxy-Tokenizer header. The proxy decrypts the secret and injects it into the client's request. To ensure that encrypted secrets can only be used by authorized clients, the encrypted data also includes instructions on authenticating the client."<p><a href="https://github.com/superfly/tokenizer">https://github.com/superfly/tokenizer</a><p>2. "Ssokenizer provides a layer of abstraction for applications wanting to authenticate users and access 3rd party APIs via OAuth, but not wanting to directly handle users' API tokens. Ssokenizer is responsible for performing the OAuth dance, obtaining the user's OAuth access token. The token is then encrypted for use with the tokenizer HTTP proxy. By delegating OAuth authentication to ssokenizer and access token usage to tokenizer, applications limit the risk of tokens being lost, stolen, or misused."<p><a href="https://github.com/superfly/ssokenizer/">https://github.com/superfly/ssokenizer/</a><p>If these sound interesting to you, click the submitted link for the "big long essay about how the thingies came to be."