91–100 of 165 posts
We are Ali and Omair of Abhi ( http://abhi.com.pk/ ). We are a financial wellness platform in Pakistan, focusing on providing early wage access to the salaried class. Most employees in Pakistan live paycheck to paycheck, not having savings for emergencies or random bills. Many pay their bills late, as payroll disbursement often does not coincide with bill cycles, incurring hefty payment fees. Fewer than 20% of the po…
We’re Aditya and Karan, the co-founders of Warrant ( https://warrant.dev/ ). We build APIs and infrastructure to help developers implement authorization and access control in their apps. Implementing flexible authorization that grows with your application is difficult. Many products only need authentication early on but eventually require authorization; however, adding complex authorization to a mature, high usage pr…
Super interesting how many companies are building authorization systems based on Zanzibar suddenly! This is a bit of a shameless plug, but I just wrote a blog post earlier today talking through how to build Zanzibar from scratch in ~150 lines of code: https://news.ycombinator.com/item?id=28076549
Not many people talk about how Zanzibar requires you re-architect your application around authorization when you really don't need to do that at all. Any sufficiently powerful authorization framework can handle the same flexibility. If not more, since most Zanzibar implementations can't handle simple attribute-based controls (e.g. anyone can read a document if its public). Which means you'll end up implementing a bunch of authorization logic in your app anyway.
---
Edit to add: I realise in hindsight I got a bit too absorbed in thinking about the Zanzibar part to say congrats on the launch! It's awesome to see the space heating up, and love to see more focus on the developer experience :)
We’re Aditya and Karan, the co-founders of Warrant ( https://warrant.dev/ ). We build APIs and infrastructure to help developers implement authorization and access control in their apps. Implementing flexible authorization that grows with your application is difficult. Many products only need authentication early on but eventually require authorization; however, adding complex authorization to a mature, high usage pr…
While I think this is a cool idea, the thought of hitting the network via an API call at minimum once per request sounds ... less than ideal. That's a lot of latency add just to check authorization. And you go to all this effort to configure authorization in Warrant per-user and per-resource, why not just put it into your own tables? Edit: and I just saw the pricing... 1k API calls a month? I'd quite literally hit th…
When we were building Oso [1], we were optimising for the best thing for developers, and reached the same conclusion as you... (a) It doesn't make sense to rearchitect your app to move all the data to a separate service, and (b) it's way less complex to build it in the application. That's why we're building Oso as an open source library instead. You get to leave your application data in the application, and don't need to worry about adding an external service to the critical path.
Hi HN, we are Bruno and Guilherme of Jestor ( https://jestor.com/ ). We make a no-code tool for COOs that need to scale complex offline operations such as hospitals, hotels and kitchens. At our previous company, a software development business, most of our clients asked us to build in-house tools like an "easy to use Salesforce" or a "lighter SAP" that would reflect their internal processes. They were tired of paying…
I may just be unfamiliar with the lingo, but I believe one of the items in the "For operations" drop-down list may contain a spelling error/typo. The list item currently reads "Heathtech", but the page it leads to reads "Healthtech".
We are Anta and Karthik of Inai ( https://www.inai.io/ ), a platform for setting up and operating your payment stack. We let you offer local payment methods, support multiple business models (e-commerce, subscriptions , platforms) and localise the checkout experience by region of operation. Setting up and maintaining a payment stack, especially if you operate in multiple regions, takes months of developer time. Most…
Hi, very interesting segment of the market! How do you compare yourself to Spreedly? How would you compete with their offering? I think these solutions are really neat, but I wonder how you can handle some edge cases which I think are really difficult. For example, let's say I want to use credit cards with Adyen. Now after a year of this, I have a lot of customers with their credit cards connected to my business via…
Hi HN, we are Bruno and Guilherme of Jestor ( https://jestor.com/ ). We make a no-code tool for COOs that need to scale complex offline operations such as hospitals, hotels and kitchens. At our previous company, a software development business, most of our clients asked us to build in-house tools like an "easy to use Salesforce" or a "lighter SAP" that would reflect their internal processes. They were tired of paying…
Love the room cleaning operations example! Would have never thought of that operation use case for a no-code tool. Congrats Bruno and Jestor!
We’re Aditya and Karan, the co-founders of Warrant ( https://warrant.dev/ ). We build APIs and infrastructure to help developers implement authorization and access control in their apps. Implementing flexible authorization that grows with your application is difficult. Many products only need authentication early on but eventually require authorization; however, adding complex authorization to a mature, high usage pr…
(Full transparency: I'm CTO/cofounder of Oso, a series A startup building an open source framework for authorization) Super interesting how many companies are building authorization systems based on Zanzibar suddenly! This is a bit of a shameless plug, but I just wrote a blog post earlier today talking through how to build Zanzibar from scratch in ~150 lines of code: https://news.ycombinator.com/item?id=28076549 Not…
I don't agree with your point that it requires developers to re-architect their systems or that it doesn't handle attribute-based controls well. If anything, I think Zanzibar actually helps developers enforce the best authz practices in their system. This becomes increasingly helpful as an application changes or grows in complexity.
To be clear, Warrant isn't just a Zanzibar implementation. We're building Authz as a service with devxp as the central focus.
Earlier quoted context omitted.
While I think this is a cool idea, the thought of hitting the network via an API call at minimum once per request sounds ... less than ideal. That's a lot of latency add just to check authorization. And you go to all this effort to configure authorization in Warrant per-user and per-resource, why not just put it into your own tables? Edit: and I just saw the pricing... 1k API calls a month? I'd quite literally hit th…
As a founder of a startup building an authorization product, I can definitely say it's super appealing to build this as a service! It makes for a an easier story around monetising it. When we were building Oso [1], we were optimising for the best thing for developers, and reached the same conclusion as you... (a) It doesn't make sense to rearchitect your app to move all the data to a separate service, and (b) it's wa…
How do you plan on monetizing, if you haven't already?
We are Ali and Omair of Abhi ( http://abhi.com.pk/ ). We are a financial wellness platform in Pakistan, focusing on providing early wage access to the salaried class. Most employees in Pakistan live paycheck to paycheck, not having savings for emergencies or random bills. Many pay their bills late, as payroll disbursement often does not coincide with bill cycles, incurring hefty payment fees. Fewer than 20% of the po…
How do you make money? Models I've seen here are all essentially riba (interest). Have you looked into sharia compliance, I would say it's necessary for your market.
Earlier quoted context omitted.
(Full transparency: I'm CTO/cofounder of Oso, a series A startup building an open source framework for authorization) Super interesting how many companies are building authorization systems based on Zanzibar suddenly! This is a bit of a shameless plug, but I just wrote a blog post earlier today talking through how to build Zanzibar from scratch in ~150 lines of code: https://news.ycombinator.com/item?id=28076549 Not…
Thanks for the response! It is interesting to see the surge in popularity of Zanzibar. Completely agree that Zanzibar itself isn't too difficult to implement (especially since Google published a paper on it). It does provide great flexibility though. I don't agree with your point that it requires developers to re-architect their systems or that it doesn't handle attribute-based controls well. If anything, I think Zan…
To give a simple example of an attribute-based control that is tough with the service model: if you want to express "anybody can read a document if it's public", then you need to push that "public" field into the service. Every attribute that you want to use for authorization becomes something that you need to either move or synchronise into the service. Or you leave that logic in the application.