OAuth 2.0 and the Road to Hell • Hacker News Board

Re: OAuth 2.0 and the Road to Hell

#71

Post by pconf » Fri, Jul 27, 2012, 4:15 PM UTC

pjzedalis wrote: post #27

I don't understand any of this. Microsoft develops and publishes 'protocols' (used lightly) and everyone hates them because they are pushing workable code out on everyone else... Bunch of people in a committee take three years trying to build the security token system to end all security token systems and have yet anything to show for it and we are sad? Why are people trying to do this anyway? oAuth is just an idea.…

Microsoft develops and publishes 'protocols' (used lightly) and everyone hates them because they are pushing workable code out on everyone else...

"workable code" is a tangent and really has nothing to do with the reason we avoid Microsoft protocols. More to the point we want to avoid APIs with elements that facilitate vendor-specific implementations i.e., lock-in. Like MS' OOXML, Oauth 2.0 has special interest written all over it.

Re: OAuth 2.0 and the Road to Hell

#72

Post by mcguire » Fri, Jul 27, 2012, 5:02 PM UTC

pjzedalis wrote: post #65

mcguire wrote: post #56

Earlier quoted context omitted.

" I don't understand any of this. Microsoft develops and publishes 'protocols' (used lightly) and everyone hates them because they are pushing workable code out on everyone else... " Have you ever tried to write an interoperable authentication system using Active Directory? I'm particularly thinking of the UDP LDAP query and the multiple-byte-order (little-endian and big-endian!) response. " Hey here's a really good…

Have you ever tried to write an interoperable authentication system using Active Directory? I'm particularly thinking of the UDP LDAP query and the multiple-byte-order (little-endian and big-endian!) response. That doesn't disprove my point. Just because you don't like their approach doesn't mean they don't get points for having an approach. So far oAuth is vaporware and not consistent in almost every implementation…

"It's not hard to adapt to using oAuth+Twists for a given provider."

I'm not sure, but I suspect that might actually be my point.

Re: OAuth 2.0 and the Road to Hell

#73

Post by malandrew » Sat, Jul 28, 2012, 5:20 PM UTC

I'd love to see OAuth 2.0 forked into a version that takes into account Eran's comments. It's be nice if the forked version explicitly mention that it will not make any compromises to support the enterprise and that the burden is on the enterprise to support the ways the internet works.

If the enterprise world wants a standard, let them make their own.