Viewing profile — jschorr

The main pain points around using a Zanzibar-like approach (typically called Relationship-based access control) are: (1) The need to write relationships and keep them updated in th…

Sweet! I'd love to see it, if you have a link, or throw it in our Discord [1]! [1]: https://discord.com/invite/GBeT3R4k84

Google's Zanzibar actually does both : for the vast majority of queries, it uses significant levels of caching and a permitted amount of staleness [1], allowing Spanner to return a…

We actually have users that synchronize their resources from various sources (AWS, Kubernetes, etc) into SpiceDB, explicitly so they can perform these kinds of queries! One of the …

In SpiceDB, this is known as the LookupResources [1] API, which returns all resources (of a particular type) that a particular subject (user in this case) has a particular permissi…

Dealing with lists is complicated with ReBAC, but possible. See my other comment on this: https://news.ycombinator.com/item?id=45662850

I'd start with reading the Zanzibar Paper. We built an annotated version [1] that provides additional guidance on some of the denser sections and how we interpreted them. Then, I'd…

It is actually slightly worse than even that: while New Enemy [1] is the primary concern, caching like this can also introduce a staleness issue from the other direction: let's say…

Happy to answer any other questions :D

> I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates. Yep, as I mentioned above, its not…

Reconciling externalized authz with search is actually quite a challenging problem. For standard externalized authz, the recommendation is some form of pre-filtering or post-filter…

We actually originally pronounced it as "kway" (the American pronunciation we had heard) but then had a saying we'd tell customers (when asked) of "pronounce it however you please,…

An amusing story of how I spent my Monday afternoon debugging a failure in our CI that mysteriously appeared over the weekend

Hi HN, I'm happy to announce the open sourcing of the SpiceDB Playground [1], our in-browser playground for developing and testing authorization systems for SpiceDB, our open sourc…

Definitely! We ourselves, in fact, use SpiceDB for our own dynamic feature flags internally.

"Can I [action]?" is the exact question that Zanzibar[0] was designed to answer in a highly performant and scalable way. With multiple data sources reading and writing to SpiceDB […

Indeed it is! :)

Zanzibar is an authorization system Google built and describes in a paper [1], which uses relationships to make authorization decisions (aka ReBAC): if there exists a path of such …

If you're curious to see a Postgres-based implementation, SpiceDB has a Postgres driver: https://github.com/authzed/spicedb/tree/main/internal/datast...

Exclusion (and intersection as well) provide for some very powerful computation primitives, with only a slight overhead in performance. In addition, there is `tupleset_to_userset` …

All custom but fully open source! Code can be found at https://github.com/authzed/zanzibar-annotated