61–70 of 78 posts
What alternatives to Auth0 are worth looking into? Between this P0 (with no ability to check the status or file a ticket) and the Okta acquisition, I hesitate to continue using Auth0 as the default when spinning up new web apps.
What's the point of such services? Every web framework worth its salt supports all common authentication schemes and offers an easy interface to write your own.
This type of incident is exactly why I dislike identity federation as a service. Yes it's difficult to get right, and you open yourself up to additional risk and technical complexity to do the federation yourself, but simultaneously how many businesses are currently completely down and just sitting on their hands waiting for Auth0's engineers to fix their systems?
While this protracted outage has prompted some plans to get rolling with a self-hosted Auth0 substitute, bear in mind that this can't address users wanting to sign in with Google, Microsoft, LinkedIn, etc., where you'll still depend on their authentication service to work correctly, not ban your client ID, and so on.
Wow. The whole point of paying someone like Auth0 is to _not_ have this happen. This is basically their whole point, is it not? Really looking forward to the post-mortem, but I won't ever forget just how down this thing is right now.
We all know that all 3rd parties will have outages at some point, nobody's pretending otherwise
Wow. The whole point of paying someone like Auth0 is to _not_ have this happen. This is basically their whole point, is it not? Really looking forward to the post-mortem, but I won't ever forget just how down this thing is right now.
> The whole point of paying someone like {insert cloud provider} is to _not_ have this happen. Being in the cloud doesn't mitigate potential issues.
Earlier quoted context omitted.
What's the point of such services? Every web framework worth its salt supports all common authentication schemes and offers an easy interface to write your own.
The target customer is IT departments who want a simpler centralized way to manage access to all of these services for the employees in their org
their dev is up, but prod is down for several hours mid day, INSANE. My users are asking me to have a failover... hard to explain they ARE the redundancy plan! Anyboy else have ideas here on how to explain to users?
Their status page is pretty depressing to read since all it really says, repeatedly, is "we're really sorry" and "we're working as hard as we can." You can just feel the abuse the person writing that must be getting from customers. I feel bad for them since they have no power to fix this and didn't cause the issue. No root cause or resolution yet and it's been 4 hours. Doesn't bode well for getting this resolved soon…
What is the ETA on getting back online? Well, about 5 minutes longer than it would have been now that you pulled me away from what I was doing....
What alternatives to Auth0 are worth looking into? Between this P0 (with no ability to check the status or file a ticket) and the Okta acquisition, I hesitate to continue using Auth0 as the default when spinning up new web apps.
Outside of that they Ory ecosystem is really nice. We user Hydra, which is not a drop-in Oauth2 server but requires you to write several of the components yourself.
Their status page is pretty depressing to read since all it really says, repeatedly, is "we're really sorry" and "we're working as hard as we can." You can just feel the abuse the person writing that must be getting from customers. I feel bad for them since they have no power to fix this and didn't cause the issue. No root cause or resolution yet and it's been 4 hours. Doesn't bode well for getting this resolved soon…
Ha, whenever some 3rd party SaaS tool is down and I am obsessively refreshing their status page I'm always enraged with the lack of updates. But then later I think about what if I were one of the engineers trying to bring things back up. There is nothing worse than being heads down trying to get a mission-critical system back online and being constantly distracted by demands for "status updates." What is the ETA on g…
Good organizations have scheduled updates for critical outages. No one pesters anyone, and everyone knows that a five minute update is expected periodically, e.g. at the top of every hour.
Great organizations instantly spin up a response team which includes a communications liaison, who is technical enough to participate in the reponse, but is not presently leading it. They assist and communicate, either to the PM or to customers directly.
...and other organizations burn through humans until they get a handle on how to be better.
That said, in these days of AWS and GCE, you can go a loong time without running into the kinds of failures that used to cause critical, extended outages.