This week, Robbie and Adam talk with Will Johnson—senior developer advocate at Auth0—about web dev, parenting, and internet culture. They debate whether CSS is a “real” programming language, riff on how modern frameworks can feel over-engineered, and dig into the security risks emerging around AI agents and MCP. Will shares what he’s been learning about MCP security, why he’s cautious with new tools, and how Auth0’s new AI agent offering helps manage identity, permissions, and token safety.

Presented by CodeRabbit: http://coderabbit.link/whiskey

In this episode:

(00:00) - Intro
(01:49) - Meet Will Johnson
(02:19) - Whiskey rating & review: Jameson Triple Triple
(07:13) - Hot Take: Git rebase vs git merge
(09:42) - Parenting talk: kids, wrestling, and learning consequences
(11:57) - Hot Take: Is CSS a programming language?
(14:37) - What Will’s working on at Auth0 (AI + MCP security)
(16:57) - The most interesting MCP-related hacks and security risks
(18:27) - Can “skills” become an attack vector too?
(19:47) - Security vulnerabilities, Next.js updates, and patching fatigue
(20:48) - How Will’s family got into K-Pop Demon Hunters
(25:51) - The Moana live-action trailer “looks like useEffect” (and why)
(27:17) - Is React essentially processed American food?
(27:58) - Sugar-free Oreos: what are we even doing here?
(29:18) - Have we overcomplicated frontend development?
(31:32) - Why Rails is the best-engineered dev experience Will has used
(32:25) - How Auth0 teams are structured
(35:47) - Passkeys explained
(41:43) - Plugs and how to connect with Will
(43:12) - How AI agents fit into auth

Links

Auth0: https://auth0.com/
Jameson Triple Triple: https://www.jamesonwhiskey.com/en-us/our-whiskey/jameson-triple-triple/
Three Sheets: https://en.wikipedia.org/wiki/Three_Sheets
Jack Daniel's Reserve: https://www.jackdaniels.com/
Google Chrome: https://www.google.com/chrome/
Shopify: https://www.shopify.com/
CSS: https://www.w3.org/Style/CSS/
JavaScript: https://developer.mozilla.org/en-US/docs/Web/JavaScript
MCP: https://modelcontextprotocol.io/
Next.js: https://nextjs.org/
KPop Demon Hunters: https://en.wikipedia.org/wiki/KPop_Demon_Hunters
Britney Spears: https://britneyspears.com/
NSYNC: https://nsync.com/
B2K: https://en.wikipedia.org/wiki/B2K
Chris Brown: https://en.wikipedia.org/wiki/Chris_Brown
Netflix: https://netflix.com
Stanford University: https://www.stanford.edu/
Moana: https://movies.disney.com/moana
Dak Prescott: https://en.wikipedia.org/wiki/Dak_Prescott
React: https://react.dev/
Oreo: https://www.oreo.com/
jQuery: https://jquery.com/
Ken Wheeler: https://x.com/ken_wheeler/
ES6: https://www.w3schools.com/js/js_es6.asp
BlingBlingjs: https://github.com/argyleink/blingblingjs
Astro: https://astro.build/
Rails: https://rubyonrails.org/
Laravel: https://laravel.com/
Egghead: https://egghead.io/
Grok: https://grok.com/
1Password: https://1password.com/
Google Zanzibar:

MCP Security, Framework Fatigue, and AI Agents with Will Johnson (Presented by CodeRabbit)