Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: BuzzFeed open source SSO

tech.buzzfeed.com

Post reply on HN
Print view View original

21–30 of 42 posts

Re: Show HN: BuzzFeed open source SSO

#21

Post by itwasntandy »

baby wrote: post #19
kingbirdy wrote: post #9

Earlier quoted context omitted.

This is mentioned in the article > In preparation for open sourcing we also engaged with Security Innovation, a widely respected agency who count Microsoft, Symantec, and Amazon as clients, to do a more in-depth, week long assessment, with full access to source code and design documents. This found no major issues, which gives us the confidence to open source sso today.

It was only a week long assessment though, I don’t know Security Innovation but I’m sure they would have appreciated more time.

That is understood, and is always why we engaged with some of the top researchers who contribute to our bug bounty program, from the start with this project.

For example offering increased bounties during certain windows, or providing early access to the source code.

We highly value our bug bounty program, and find it to be a very effective mechanism for continuous security validation.

I'll write a tech blog post in the near future about how we facilitate our program.

Re: Show HN: BuzzFeed open source SSO

#23

Post by gknoy »

xeromal wrote: post #17
andremat wrote: post #8

Earlier quoted context omitted.

Have you contracted an independent pen-testing company to assess your design and implementation?

Why don't people read shit before posting?

In the blog article, they state:

> we have made sso a priority target for penetration testing by researchers on our bug bounty program — we’ve paid bounties for a number of reported issues!

While that makes it clear that they cared about penetration testing, it isn't what the person was asking to that you replied to -- they asked if they had contracted with an independent company to do testing. This did not seem to be answered by the article, and seems like a reasonable question to ask.

Re: Show HN: BuzzFeed open source SSO

#24

Post by yubozhao »

itwasntandy wrote: post #21
baby wrote: post #19

Earlier quoted context omitted.

It was only a week long assessment though, I don’t know Security Innovation but I’m sure they would have appreciated more time.

That is understood, and is always why we engaged with some of the top researchers who contribute to our bug bounty program, from the start with this project. For example offering increased bounties during certain windows, or providing early access to the source code. We highly value our bug bounty program, and find it to be a very effective mechanism for continuous security validation. I'll write a tech blog post in…

Looking forward to read about it. Thank you for the project!

Re: Show HN: BuzzFeed open source SSO

#26

Post by itwasntandy »

snuxoll wrote: post #20
itwasntandy wrote: post #2

GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!

Neat project, but I have to ask why you didn't go with an existing solution like Keycloak?

Hey,

there were a few reasons behind this.

- ease of migration was a big one, we had 100+ instances of bitly's oauth2_proxy, and were able to seamlessly migrate them to this, without any changes to the services being protected.

- ease of deployment was also important. Our solution doesn't have any datastore dependencies, and is stateless, so was straightforward to deploy into our PaaS ( https://tech.buzzfeed.com/deploy-with-haste-the-story-of-rig... ).

- when we built this, there were far fewer solutions than there are today. For example, Ory's Oathkeeper ( https://github.com/ory/oathkeeper) was released after we were already using sso internally at BuzzFeed.

thanks!

Re: Show HN: BuzzFeed open source SSO

#28

Post by itwasntandy »

Signez wrote: post #12
itwasntandy wrote: post #2

GitHub repo: https://github.com/buzzfeed/sso This is our identity aware proxy, which we've been using internally for a year. The blog post explains our motivations behind creating it, and open-sourcing it. It's available today, under MIT license. We'll be keeping an eye on the thread, and happy to follow up to any questions!

Thank you for not having just dumped it like that, but adding quick-start guides, examples and even did some additionnal security checks, it's just awesome for little organizations <3

thank you - We know from our own experience using other open source projects that having documentation, and guides to get started really helps.

We know there is more to do there too (some of the feedback in this HN post has helped highlight areas we need to improve the docs) and we will be adding to the docs so over the next while.

We will also welcome PRs improving the docs!

Re: Show HN: BuzzFeed open source SSO

#29

Post by itwasntandy »

markovbot wrote: post #27

Looks super interesting. I'm looking to do something like this for my personal stuff, but I'd rather avoid the dependency on Google. Does anyone have suggestions for how to set something like that?

Right now we have a dependency on Google as an OAuth2 provider, as that's what we use internally at BuzzFeed. However we've designed sso to allow us to easily add other providers.

For example, there's this task ( https://github.com/buzzfeed/sso/issues/9 ) to create a default provider without Google dependencies for test purposes.

We'd also welcome PRs adding other providers and believe any OAuth2 provider should be straight forward to add.

Re: Show HN: BuzzFeed open source SSO

#30

Post by markovbot »

itwasntandy wrote: post #29
markovbot wrote: post #27

Looks super interesting. I'm looking to do something like this for my personal stuff, but I'd rather avoid the dependency on Google. Does anyone have suggestions for how to set something like that?

Right now we have a dependency on Google as an OAuth2 provider, as that's what we use internally at BuzzFeed. However we've designed sso to allow us to easily add other providers. For example, there's this task ( https://github.com/buzzfeed/sso/issues/9 ) to create a default provider without Google dependencies for test purposes. We'd also welcome PRs adding other providers and believe any OAuth2 provider should be s…

Cool, thanks for letting me know. I'll have to research this more.
Post reply on HN