Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Shopify implemented its secure authentication service

engineering.shopify.com

Post reply on HN
Print view View original

31–40 of 56 posts

Re: How Shopify implemented its secure authentication service

#31

Post by jammygit »

eropple wrote: post #19
Nextgrid wrote: post #15

Earlier quoted context omitted.

Remember that the hyped-up companies you hear about on HN & other social media aren't the entire world. There are plenty of companies out there that stay quiet and outside of the spotlight and use the language just fine. The same applies for PHP and other languages that are considered (unfairly IMO) "old-school".

PHP is rarely considered "old school." It's considered bad. And not without reason given its history of hostility to its own developers and the sysadmins who have to manage it. I think pretty much everyone has acknowledged that it's improved. Where opinions differ is in how much it has improved and whether that's enough to entertain its use (my answers to which are "not enough" and "not even if you paid me", respecti…

What is it like to use pho compared to nodejs or python? Some of us haven’t had the pleasure

Re: How Shopify implemented its secure authentication service

#33

Post by riffraff »

keithwhor wrote: post #5
noodle wrote: post #4

Earlier quoted context omitted.

IIRC there are still many large companies using Ruby/Rails still, they've just also diversified their tech stacks (as larger companies tend to do). AFAIK the list includes: GitHub (MS has a few Rails-based acquisitions now), Airbnb, Groupon, Square, Cookpad, Kickstarter, Hulu, etc..

Pretty sure Stripe is a Ruby shop as well.

IIRC it's ruby, but not rails

Re: How Shopify implemented its secure authentication service

#34

Post by riffraff »

meagar wrote: post #16
pm90 wrote: post #3

It’s not mentioned but I’m assuming that they built their own OIDC/OAuth backend and not use existing ones (eg okta, Auth0 etc). It would be interesting to know the details of how they’re doing authorization. It appears that it’s all or nothing but I might be mistaken.

Hey, I worked on this project for ~2 years, though I'm no longer with Shopify. We started with Doorkeeper and gradually switched to building our own OAuth2/OIDC implementation over time, partially using glued together lower-level libraries like https://github.com/nov/openid_connect Edit: I forgot, I even have a few small commits to that last project from my time at Shopify: https://github.com/nov/openid_connect/commi…

So, did you have issues with doorkeeper that forced you to switch? Or was it just not fit for the problem you were trying to solve?

I've used it a bit in the past and it worked fine, but I didn't really push it.

Re: How Shopify implemented its secure authentication service

#35

Post by notyourwork »

itake wrote: post #28
noodle wrote: post #4

Earlier quoted context omitted.

IIRC there are still many large companies using Ruby/Rails still, they've just also diversified their tech stacks (as larger companies tend to do). AFAIK the list includes: GitHub (MS has a few Rails-based acquisitions now), Airbnb, Groupon, Square, Cookpad, Kickstarter, Hulu, etc..

Insiders at Airbnb told me they are (almost) completely off Rails now. They moved their website to the jvm.

Seems at some scale this usually happens.

Re: How Shopify implemented its secure authentication service

#36

Post by winrid »

jammygit wrote: post #31
eropple wrote: post #19

Earlier quoted context omitted.

PHP is rarely considered "old school." It's considered bad. And not without reason given its history of hostility to its own developers and the sysadmins who have to manage it. I think pretty much everyone has acknowledged that it's improved. Where opinions differ is in how much it has improved and whether that's enough to entertain its use (my answers to which are "not enough" and "not even if you paid me", respecti…

What is it like to use pho compared to nodejs or python? Some of us haven’t had the pleasure

Imagine JavaScript, but more like Java, but not very strictly typed, half the methods in the standard library follow different patterns for method signatures, and no event loop or JIT.

That being said, I have yet to see a NodeJS framework beat developer productivity in Symphony or Larvel for CRUD stuff. Django maybe.

Re: How Shopify implemented its secure authentication service

#37

Post by rurounijones »

chrisseaton wrote: post #26
uyuioi wrote: post #18

Earlier quoted context omitted.

Hopefully crystal Lang will make its way into these ruby heavy shops. They’ll get 100x performance without needing to really think in a whole different programming experience.

> without needing to really think in a whole different programming experience But Crystal has entirely different semantics to Ruby. They look vaguely similar at a superficial level, but the semantics are not even remotely similar.

Maybe but depending on what you are doing they are minor considerations.

I am porting a relatively simple ruby app to Crystal to see how it is and most of it is copy/paste and then some fixing and adding type definitions where needed. The only issues I have had are where I am using a rubygem that doesn't have a crystal counterpart.

For example a pretty simple Gem that connects to a socket and parses incoming data was exceedingly easy to port, including tests.

* https://gitlab.com/overlord-bot/tacview-ruby-client

* https://gitlab.com/overlord-bot/tacview-crystal-client

For a more specific example these two files are almost identical:

* https://gitlab.com/overlord-bot/tacview-ruby-client/blob/mas...

* https://gitlab.com/overlord-bot/tacview-crystal-client/blob/...

The only thing not done was CRC hash calculating for a password because there was no crystal shard for it and it was low priority so I didn't write one.

Re: How Shopify implemented its secure authentication service

#38

Post by IfOnlyYouKnew »

jammygit wrote: post #31
eropple wrote: post #19

Earlier quoted context omitted.

PHP is rarely considered "old school." It's considered bad. And not without reason given its history of hostility to its own developers and the sysadmins who have to manage it. I think pretty much everyone has acknowledged that it's improved. Where opinions differ is in how much it has improved and whether that's enough to entertain its use (my answers to which are "not enough" and "not even if you paid me", respecti…

What is it like to use pho compared to nodejs or python? Some of us haven’t had the pleasure

It's... ugly? I started with PHP, like many. And the documentation was excellent, as were deployment options. But even though familiarity tends to breed sympathy, it took me only five minutes of seeing Ruby to question why I ever put up with PHP. Just the need to prefix $variables alone is off-putting, and so were the inconsistancies in style. There were camelCase() functions, but also under_score(). Sometimes it was search_all(), then find_all(), next all_matching(). Some counting method might actually return 0, others nil (for zero matches). And I seem to remember one even returned the string "0".

(not actual examples–I have luckily forgotten)

Re: How Shopify implemented its secure authentication service

#39

Post by [deleted] »

winrid wrote: post #36
jammygit wrote: post #31

Earlier quoted context omitted.

What is it like to use pho compared to nodejs or python? Some of us haven’t had the pleasure

Imagine JavaScript, but more like Java, but not very strictly typed, half the methods in the standard library follow different patterns for method signatures, and no event loop or JIT. That being said, I have yet to see a NodeJS framework beat developer productivity in Symphony or Larvel for CRUD stuff. Django maybe.

[deleted]

Re: How Shopify implemented its secure authentication service

#40

Post by cutler »

itake wrote: post #28
noodle wrote: post #4

Earlier quoted context omitted.

IIRC there are still many large companies using Ruby/Rails still, they've just also diversified their tech stacks (as larger companies tend to do). AFAIK the list includes: GitHub (MS has a few Rails-based acquisitions now), Airbnb, Groupon, Square, Cookpad, Kickstarter, Hulu, etc..

Insiders at Airbnb told me they are (almost) completely off Rails now. They moved their website to the jvm.

If all you want is the JVM JRuby and its Truffle variant are viable options.
Post reply on HN