Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Okta's NextJS-0auth troubles

joshua.hu

Post reply on HN
Print view View original

11–20 of 167 posts

Re: Okta's NextJS-0auth troubles

#11

Post by parliament32 »

jonathaneunice wrote: post #6
cedws wrote: post #3

That’s funny. I spotted a similar issue in their Go SDK[1] a few years back. I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. [1]: https://github.com/okta/okta-sdk-golang/issues/306

> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.

We evaluated them a while ago but concluded it was amateur-hour all the way down. They seem to be one of those classic tech companies where 90% of resources go to sales/marketing, and engineering remains "minimum viable" hoping they get an exit before anyone notices.

Re: Okta's NextJS-0auth troubles

#12

Post by jchw »

hypeatei wrote: post #7

I think GitHub should allow disabling PRs. I don't believe most big corporations are interested in dealing with fly-by contributions because it might make them look bad or be riddled with quality issues. Also some projects like the Linux kernel are just mirrors and would be better off with that functionality disabled.

While that is true, I feel like it is irrelevant here since it seems like Okta definitely wants (and perhaps needs) the fixes. God only knows why GitHub still forces it on though. Early on it might've been some mechanism to encourage people to accept contributions to push the social coding aspect, but at this point I have no idea who this benefits, it mostly confuses people when a project doesn't accept PRs.

Re: Okta's NextJS-0auth troubles

#14

Post by [deleted] »

hypeatei wrote: post #7

I think GitHub should allow disabling PRs. I don't believe most big corporations are interested in dealing with fly-by contributions because it might make them look bad or be riddled with quality issues. Also some projects like the Linux kernel are just mirrors and would be better off with that functionality disabled.

[deleted]

Re: Okta's NextJS-0auth troubles

#15

Post by hypeatei »

jchw wrote: post #12
hypeatei wrote: post #7

I think GitHub should allow disabling PRs. I don't believe most big corporations are interested in dealing with fly-by contributions because it might make them look bad or be riddled with quality issues. Also some projects like the Linux kernel are just mirrors and would be better off with that functionality disabled.

While that is true, I feel like it is irrelevant here since it seems like Okta definitely wants (and perhaps needs ) the fixes. God only knows why GitHub still forces it on though. Early on it might've been some mechanism to encourage people to accept contributions to push the social coding aspect, but at this point I have no idea who this benefits, it mostly confuses people when a project doesn't accept PRs.

> Okta definitely wants (and perhaps needs) the fixes

They definitely don't want them if their process requires signed commits and their solution is 1) open another PR with the authors info then sign it for them, and 2) add AI into the mix because git is too hard I guess?

No matter how you slice it, it doesn't seem like there are Okta employees who want to be taking changes from third parties.

Re: Okta's NextJS-0auth troubles

#16

Post by petre »

jchw wrote: post #12
hypeatei wrote: post #7

I think GitHub should allow disabling PRs. I don't believe most big corporations are interested in dealing with fly-by contributions because it might make them look bad or be riddled with quality issues. Also some projects like the Linux kernel are just mirrors and would be better off with that functionality disabled.

While that is true, I feel like it is irrelevant here since it seems like Okta definitely wants (and perhaps needs ) the fixes. God only knows why GitHub still forces it on though. Early on it might've been some mechanism to encourage people to accept contributions to push the social coding aspect, but at this point I have no idea who this benefits, it mostly confuses people when a project doesn't accept PRs.

Social on today's Internet = bots and occasionally trolls

Re: Okta's NextJS-0auth troubles

#17

Post by rcleveng »

Honestly when I saw Okta in the headline, I had assumed the article was going to say they were breached again.

This one is amusing, and as another comment mentioned below, large companies are awful at accepting patches on github. Most use one-way sync tools to push from their internal repositories to github.

Re: Okta's NextJS-0auth troubles

#19

Post by mananaysiempre »

hypeatei wrote: post #7

I think GitHub should allow disabling PRs. I don't believe most big corporations are interested in dealing with fly-by contributions because it might make them look bad or be riddled with quality issues. Also some projects like the Linux kernel are just mirrors and would be better off with that functionality disabled.

GitHub actually can natively mark a repo as a mirror (or could? I can’t find an example now, but they have always been rare). The book-with-bookmark icon before “user / repo” in the page header is replaced by a mirror-and-reflection-ish–looking thing, and the badge after it changes from “Public” to “Public mirror”. Unfortunately, forcing you into “social coding” (wait, is that no longer on the homepage?) takes priority, so that mark can only be given out by GitHub staff through manual intervention, and it doesn’t often happen.
Post reply on HN