Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Okta's NextJS-0auth troubles

joshua.hu

Post reply on HN
Print view View original

61–70 of 167 posts

Re: Okta's NextJS-0auth troubles

#61

Post by parliament32 »

atonse wrote: post #44
iloveplants wrote: post #39

Earlier quoted context omitted.

well, it was distasteful of to them to close op's pr and apply the same patch with improper attribution, and then use ai to respond when they were asked about it

I agree with the parent post that it's distasteful. There's no value in naming the employee. Whatever that employee did, if the company needed to figure out who it was, they can from the commit hashes, etc. But there's no value in the public knowing the employee's name. Remember that if someone Googles this person for a newer job, it might show up. This is the sort of stuff that can disproportionately harm that perso…

> Remember that if someone Googles this person for a newer job, it might show up.

That's the whole point; I sincerely hope it does. Why would anyone want to hire someone that delegates their core job to a slop generator?

Re: Okta's NextJS-0auth troubles

#64

Post by technion »

Freak_NL wrote: post #59
atonse wrote: post #44

Earlier quoted context omitted.

I agree with the parent post that it's distasteful. There's no value in naming the employee. Whatever that employee did, if the company needed to figure out who it was, they can from the commit hashes, etc. But there's no value in the public knowing the employee's name. Remember that if someone Googles this person for a newer job, it might show up. This is the sort of stuff that can disproportionately harm that perso…

> Remember that if someone Googles this person for a newer job, it might show up. Not to sound too harsh, but this is a person who rudely let AI perform a task badly which should have been handled by just… merging/rebasing the PR after confirming it does what it should do, then couldn't be bothered to reply and instead let the robot handle it, and then refused to fix the mess they made (making the apology void). That…

I agree what occurred is quite egregious. But "use ai to talk to customers" and "play games with signed commits" sound much more like corporate policy than one employees mistake.

Re: Okta's NextJS-0auth troubles

#67

Post by fudged71 »

I'm currently building on the Auth0 SaaStarter because it seemed to be the only option in the market for something with all the core features enterprises are looking for. Is there an alternative that doesn't require building from scratch?

Re: Okta's NextJS-0auth troubles

#68

Post by pm90 »

jonathaneunice wrote: post #6
cedws wrote: post #3

That’s funny. I spotted a similar issue in their Go SDK[1] a few years back. I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. [1]: https://github.com/okta/okta-sdk-golang/issues/306

> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.

okta is the worst. Their support is the worst (we always got someone overseas who only seemed to understand anything, probably they were trained on some corpus) and would take forever to loop in anyone that could actually help.

Re: Okta's NextJS-0auth troubles

#69

Post by cookiengineer »

cedws wrote: post #3

That’s funny. I spotted a similar issue in their Go SDK[1] a few years back. I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. [1]: https://github.com/okta/okta-sdk-golang/issues/306

Kind of funny that stalebots are the new "won't fix" methodology to ignore security issues with plausible deniability.

Re: Okta's NextJS-0auth troubles

#70

Post by lq9AJ8yrfs »

jonathaneunice wrote: post #6
cedws wrote: post #3

That’s funny. I spotted a similar issue in their Go SDK[1] a few years back. I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. [1]: https://github.com/okta/okta-sdk-golang/issues/306

> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.

Among the reasons to leave my last job was a CISO and his minion who insisted spending $50k+ on Okta for their b2b customer and employee authentication was a bulletproof move.

When I brought it up, they said they didn't have anyone smart enough to host an identity solution.

They didn't have anyone smart enough to use Okta either. I had caught multiple dealbreakers-for-me such dubious / conflicting config settings resulting in exposures, actual outages caused by forced upgrades, not to mention their lackluster responses to bona fide incidents over the years.

I use Authentik for SSO in my homelab, fwiw.

Post reply on HN