Very similar, both let you decode and verify signatures of JWTs, with educational resources.

Basically, two sites that help devs understand JWTs, from two different companies.

> Is it some type of candy that looks like the fruit?

No, they are a variety of blueberries.

> Why is it on-topic?

It would have been better to post something about how they were bred, but I just ran across them on that site and wanted to post. They look, as you said, like candy, and I thought that was weird and interesting.

Edit, just found this from 2023: https://fruitgrowersnews.com/article/pink-cosmo-berries-a-hi...

Weird and interesting indeed.

How are agents authenticated?

I searched the docs for authentication and mcp (one of the protocols which, among other things, handles some pieces of authentication/authorization) but didn't see any results.

What did I miss?

What does KLTO mean?

To add to the other posters, keep-the-lights-on usually means a product has no active feature development. It’s just supported with on-call and maybe some bug fixes depending on capacity.

No clue if Cognito actually was KTLO though.

Probably meant KTLO: Keep The Lights On

"Keep Lights To On." It's the post-it on the light switch wired to the Cognito server.

I work for a Cognito competitor, but I am glad to see them investing in improving the lives of folks using this native AWS service.

It felt like Cognito was abandoned for a while.

That's fair. The companies do care about building a sustainable business. But so do the companies that sell lawnmowers.

I'm not sure that make either thing being sold (LLMs or machines to cut grass) able to care.

Not yet. Wait ‘til lawnmowers have LLMs installed.

I have seen the same thing in a local slack I frequent. Not weekly, but once a month or so.

It doesn't last long, but it sure is annoying. Sometimes they even join and then spam DM rather than post in a public channel.

It must pay off often enough to make it it worth it, but I can't imagine hiring someone I found through a spam message.

There's no way this pays off. It's probably some enterprising scammer that's selling his bots to individuals (aka suckers) to spam with.

I mean, the device code grant was codified by the IETF in 2019[0]. That is no guarantee that it is 100% secure, but folks have spent time working to make it as safe as possible. There's also a Best Current Practice (BCP) doc[1] and if you have suggestions to improve the flow, they'd be welcomed.

0: https://datatracker.ietf.org/doc/html/rfc8628

1: https://datatracker.ietf.org/doc/draft-ietf-oauth-cross-devi...