Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth for all

blog.cloudflare.com

Post reply on HN
Print view View original

11–20 of 174 posts

Re: OAuth for all

#11

Post by xyzzy_plugh »

parsadotsh wrote: post #9
xyzzy_plugh wrote: post #8

This is such a weird blog post. It's full of technical details, but I'm really not sure who they're for. There's nothing particularly novel or impressive. If anything the fact that it took them this long should be embarrassing. They pad it out with a table of stats that are just kind of meh? Congrats I guess for releasing something without burning the house down? As an on-and-off customer of theirs I tried to quickly…

I for one appreciate them sharing this and found it a very interesting read. Many of us don't have experiences at companies at this scale and so it's nice whenever I get to read about what happens behind the scene.

Usually I expect an eng blog post to be a recruitment vehicle, wherein the authors articulate a really hard problem they solved, or some novel approach they took, or the cool new open source project they released (for their future SaaS play).

But this is so mundane it bothers me in a way I find surprising. It's more about how they made some questionable choices in the past and how they finally paid off that technical debt. Is it interesting? Perhaps I am just getting old and jaded.

What I find odd is how light TFA is on actual details as to what it is they shipped.

This is the kind of thing I'd ship internally to the org as part of a weekly update or something, but not what I'd expect on a public-facing corporate blog.

Re: OAuth for all

#12

Post by zaptheimpaler »

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I just hope to god they leave in the simple shit for personal use. I just want a damn API key, I keep it a secret and revoke if necessary and don't need 10000 layers of auth bullshit tangled up in every layer of every platform.

Re: OAuth for all

#13

Post by necovek »

I thought I understood what Oauth was (a standardized protocol to provide per-client access keys), but this article confuses me.

What's a "self-managed" Oauth here? What is access is being granted to, who are the clients, who are the partners...?

Anyone care to elaborate?

Re: OAuth for all

#14

Post by weird-eye-issue »

asdf88990 wrote: post #3

Cloudflare turning into a Cloud platform is undoing what it was really doing well: making small clouds and diy hosting manageable in the hostile web environment. Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on.

> Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on.

Wait so what do you think their core offering is?

Re: OAuth for all

#15

Post by Groxx »

necovek wrote: post #13

I thought I understood what Oauth was (a standardized protocol to provide per-client access keys), but this article confuses me. What's a "self-managed" Oauth here? What is access is being granted to, who are the clients, who are the partners...? Anyone care to elaborate?

>Earlier this month, we announced self-managed OAuth, making it easier for customers to create and manage their own OAuth clients for delegated access to the Cloudflare API.

They're letting you host an OAuth system to approve/deny access to your own resources, so you can build whatever logic you like, rather than waiting on them to allow you to do X under Y conditions. Essentially "log into CloudFlare" -> CF sees you're using this self-managed OAuth -> redirect to your OAuth -> CF trusts your response, and approves access to your account if you approve access.

Re: OAuth for all

#16

Post by holistio »

system2 wrote: post #10

I hope Cloudflare does not turn into Google, with so many different things that they will eventually kill all of these services randomly because of the maintenance cost.

I still kind of think of Cloudflare as "big ass CDN".

I can't keep track of all the new things they do. Something-something-R2? Maybe?

Re: OAuth for all

#17

Post by jurgenaut23 »

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

I am tempted to agree with you because I could never quite wrap up my head around it, but I never had to implement OAuth beyond a brief skim through the doc for my own understanding. I always thought this complexity was there for some good reason (security?).

Re: OAuth for all

#18

Post by willtemperley »

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when.

It's a privacy nightmare.

Re: OAuth for all

#19

Post by rozenmd »

asdf88990 wrote: post #3

Cloudflare turning into a Cloud platform is undoing what it was really doing well: making small clouds and diy hosting manageable in the hostile web environment. Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on.

Cloudflare free is the business model: https://blog.cloudflare.com/cloudflares-commitment-to-free/

Re: OAuth for all

#20

Post by usr1106 »

ok_dad wrote: post #6
sandeepkd wrote: post #4

Not sure whats the play here, there is no world where this can turn out good. Cloudflare is more or less infrastructure provider, this idea of some user delegating permissions to their account to some third party client for infrastructure is ripe for abuses. If companies like AWS are not doing it then its for a good reason.

Do you understand what OAuth is? It’s like an API key but less likely to be abused. This is a good thing. It helps security in many ways and makes security flows more safe than carrying around a token.

Maybe he doesn't. And I know that I don't (at least not in depth). And that's the frightening thing here. Using a protocol that many don't understand for access to valuable resources
Post reply on HN