41–50 of 54 posts
This is a very well written announcement. It immediately defines OPA (for people like me who don’t immediately recognize it). It says what’s not changing for people, and says where things will go. Congratulations to the team.
Outer Planets Alliance. Bloody terrorists they are.
Earlier quoted context omitted.
Can you explain why
At scale, the larger companies end up needing to be able to make policy decisions (read: authn/authz, most of the time) across a large number of "policies" in an efficient way. Everybody starts with simple representations that can go fast but have limited expression, then moves to various forms of extensions/templating/substitution/rules/etc. OPA and Rego use a datalog variant to bring order to that bespoke mess. Thi…
I’m very familiar with opa.
My only assumption for this was that Apple’s infrastructure needs have evolved to the point where they need quite a focused effort around policy.
Styra either acquired or became available through a different form of change management. And Apple was already a major customer.
Just blind guesses. I was hoping for more insight.
With Both Aserto and Styra gone - there aren't any commerical/enterprise options to get capabilities and support around OPA. Has anyone seen more options?
Earlier quoted context omitted.
Permit.io
they don't actually "support" OPA. more like they run/depend on OPA
Actually, Permit does support OPA. In fact, about 15% of our large customers came from StyraDAS and use Permit as their enterprise OPA solution.
On top of that, we offer OPAL+, which is already adopted by Fortune 100 companies as a production-grade OPA framework.
It's great to see authorization getting more attention in the mainstream developer conversation.
For folks exploring policy-based authorization solutions, we've written up a detailed comparison between Cerbos and OPA that might be helpful: https://www.cerbos.dev/blog/cerbos-vs-opa
The key differences tend to be around developer experience, policy language complexity, and deployment patterns. Both are solid open source options depending on your specific needs.
(Disclosure: I'm a cofounder of Cerbos)
With Both Aserto and Styra gone - there aren't any commerical/enterprise options to get capabilities and support around OPA. Has anyone seen more options?
This is a very well written announcement. It immediately defines OPA (for people like me who don’t immediately recognize it). It says what’s not changing for people, and says where things will go. Congratulations to the team.
> It says what’s not changing for people For the people who are currently experiencing the first time a project they heavily used gets acquired by a for-profit company, it's worth remembering that everything written is "As it stands currently", which can change at any time. It wouldn't be the first time the founders/company/project said "Nothing will change now when we got acquired" only for it to shutdown/change dra…
Earlier quoted context omitted.
I was left with the somewhat opposite feeling. I still don’t know what OPA actually is or does. It has a nice paragraph describing it without saying anything at all.
OPA solves the problem of defining and enforcing policies across a system. Some examples: - How do I enforce that inbound API requests come only from trusted sources? - How do I enforce fine-grained access to user records? - How do I enforce a set of naming conventions for a data update? Many such policies may come from regulatory requirements, may be regional in nature, and may change in otherwise stable codebases.…
It's as though you're describing a car to someone who's never seen a car before by listing all the places you can go in a car.
Earlier quoted context omitted.
OPA solves the problem of defining and enforcing policies across a system. Some examples: - How do I enforce that inbound API requests come only from trusted sources? - How do I enforce fine-grained access to user records? - How do I enforce a set of naming conventions for a data update? Many such policies may come from regulatory requirements, may be regional in nature, and may change in otherwise stable codebases.…
That's still not saying what it is, though. Is it a thing you put in front of your backend to allow/deny requests? Is it an endpoint something like nginx calls with an auth token and the http verb and url that responds with 200/403 that nginx can react to? Is it a library you embed in your application? Is it an agentic AI? It's as though you're describing a car to someone who's never seen a car before by listing all…
Use their library in your application to evaluate policies.
Run it from the cli.
Embed it in some service like nginx.
The language itself is pretty focused on some prolog-ish describing of what constitutes an allow/deny decision.
Based on Apple's acquisition of FoundationDB, this seems like it will have negative consequences for public development of OPA. What are the counterexamples, where Apple acquiring a project results in it being more open with sustained development?
How did this idiotic, uninformed meme come about exactly?