[dead]
OAuth for all
101–110 of 174 posts
Re: OAuth for all
#102Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…
I would be so glad to see a short educational video about this. I wasn't aware of this and I think millions of other devs aren't either. Otherwise we'd never have adopted this nightmare.
I love how simple SSH is with it's PK-Auth. The only challenge is session-invalidation and key-management, but that can be surely automated, no?
Re: OAuth for all
#103Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…
What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.
I've done a bit of experimentation in this area. Check out https://lastlogin.net/.
You may also be interested in the FedCM protocol Google is working on.
Re: OAuth for all
#104Earlier quoted context omitted.
What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.
Slight tangent. The only way to preserve privacy while having a central and easy authentication mechanism I can think of is to use IndieAuth[0] which is built on top of OAuth 2.0. Of course, you will need to be your own provider, using an IndieAuth provider service defeats the purpose, which is what I see most IndieWeb devs are doing. You will need to own a (sub)domain though. [0] https://indieweb.org/IndieAuth?redir…
Take a look at Google's FedCM protocol as well
Re: OAuth for all
#105Classic Cloudflare, for all, works well, not too expensive... but, and consequently of all those positive attributes, positioning itself at the center of everything.
Cloudflare is one of the most expensive providers out there once you step out of the basics. Look at their video streaming.
I don't think that's necessarily true. Certainly the video streaming is expensive, but other things like workers and KV store are quite cheap and performant and powerful _if you structure your access patterns accordingly_ .
Cloudflare pricing introduces an additional dimension for when you're architecting software on top of them, but if you do it correctly, your product has the potential to be faster, cheaper, and easier to run than traditional solutions running on multiple geographically distributed VMs. You just can't approach them as if they're just another VM instance provider and expect a similar experience and pricing. What they do and price for is fundamentally different from that.
Re: OAuth for all
#106I used to manage a self hosted instance of the identity server framework for dotnet that ran several billions of requests per month, my experience managing OAuth and OpenID Connect at that scale was that it was pretty much a solved problem with relatively low maintenance *(it was a critical core service at our org, with heavy compliance, but our team was maybe 3 people taking care of it? it is still up and well to this day)*
I could never understand why there were so much confusion spread around this protocol, almost every junior engineer I worked with would just struggle grasping it, I cannot recommend Scott Brady's blog enough on the topic https://www.scottbrady.io/ it was illuminating to me
I think there's an essential primitive "fear" whenever authN/Z is involved that creates friction for most engineers, they're used to problem solving and this fits within a pre-condition to your problem solving so there's a cognitive tax or something around it
Re: OAuth for all
#107Author of Ory Hydra here! Very cool to see this blog post and technical description! I never would have thought this piece of software would secure the internet companies in the world :) Also great to see that the 2.x version performs so well for you! The CPU use is ridiculously small for that scale! We have a commercial variant that‘s even faster, if you ever run into trouble. If anyone here is interested in providi…
thank u for Hydra, its great!
Re: OAuth for all
#108"Ory Enterprise License: Unlock enterprise-grade features like security SLAs for CVEs, SAML, B2B organizations, multi-tenancy, and better scalability." [0] Or just stick with KeyCloak that offers a full self hosted product... [1] [0] https://github.com/ory [1] https://www.keycloak.org/
Having dealt with Keycloak in production it's not that great. Maybe if it didn't use Infinispan and JGroups internally. Both are absurdly complex for no reason.
Re: OAuth for all
#109[flagged]
Re: OAuth for all
#110Cloudflare really likes to publish new projects, but improving them in the future is not really their style. Some examples: - They launched Cloudflare Web Analytics in 2020, but it still does not support basic things such as UTM parameters or custom events - With wrangler (their CLI), you still cannot undeploy a Cloudflare Page
The last commit to wrangler was 2 hours ago? https://github.com/cloudflare/workers-sdk/tree/main/packages...
That’s exactly the point.
Wrangler, being cloudflare’s primary CLI tool, is a microcosm of exactly the problem GP was articulating: it’s focused way more on adding new commands than improving existing ones.
Many products, even supposedly “GA” ones, still lack basic operability via wrangler because instead of finishing building out its capabilities to manage existing services, they prioritized adding rudimentary support for new ones.