Show HN: BuzzFeed open source SSO
tech.buzzfeed.com
Show HN: BuzzFeed open source SSO
1–10 of 42 posts
Re: Show HN: BuzzFeed open source SSO
#2GitHub repo: https://github.com/buzzfeed/sso
This is our identity aware proxy, which we've been using internally for a year.
The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license.
We'll be keeping an eye on the thread, and happy to follow up to any questions!
Re: Show HN: BuzzFeed open source SSO
#310 ways you can make use of this open source SSO. You won't believe what #7 is.
Re: Show HN: BuzzFeed open source SSO
#410 ways you can make use of this open source SSO. You won't believe what #7 is.
Why so snarky?
It might not be necessary, because there are already a few good identity providers around, but isn't it always good when companies release quality open source software?
Re: Show HN: BuzzFeed open source SSO
#5Short string optimisation? Ah, no I guess not.
Re: Show HN: BuzzFeed open source SSO
#610 ways you can make use of this open source SSO. You won't believe what #7 is.
Why so snarky? It might not be necessary, because there are already a few good identity providers around, but isn't it always good when companies release quality open source software?
From what I can gather, gp posted a joke in reference to the usual clickbait headlines of BuzzFeed, not against the code itself.
Re: Show HN: BuzzFeed open source SSO
#710 ways you can make use of this open source SSO. You won't believe what #7 is.
Why so snarky? It might not be necessary, because there are already a few good identity providers around, but isn't it always good when companies release quality open source software?
just a joke poking fun at listicle's. like https://www.buzzfeed.com/rsultan/11-baby-animals-who-fell-as...
Re: Show HN: BuzzFeed open source SSO
#8GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!
Have you contracted an independent pen-testing company to assess your design and implementation?
Re: Show HN: BuzzFeed open source SSO
#9GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!
Have you contracted an independent pen-testing company to assess your design and implementation?
This is mentioned in the article
> In preparation for open sourcing we also engaged with Security Innovation, a widely respected agency who count Microsoft, Symantec, and Amazon as clients, to do a more in-depth, week long assessment, with full access to source code and design documents. This found no major issues, which gives us the confidence to open source sso today.
Re: Show HN: BuzzFeed open source SSO
#10GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!
Have you contracted an independent pen-testing company to assess your design and implementation?
Yes, as mentioned in the blog post, we worked with Security Innovation to do a week long security assessment with full access to source code, design documents and endpoints.
We also have a long term consulting arrangement with a widely respected security architect, and they helped review our design and implementation.
Additionally, BuzzFeed has a bug bounty program on hackerone (https://hackerone.com/buzzfeed), and have invited partipating researchers to report on any issues found. We’ve paid out bounties for a number of minor issues, which were addressed prior to open-sourcing.
Additionally, knowing that security is never done, we continue to make it eligible for bounties -- see https://github.com/buzzfeed/sso/blob/master/README.md#securi...