[dead]
Okta's NextJS-0auth troubles
71–80 of 167 posts
Re: Okta's NextJS-0auth troubles
#72[deleted]
Re: Okta's NextJS-0auth troubles
#73Earlier quoted context omitted.
> Remember that if someone Googles this person for a newer job, it might show up. Not to sound too harsh, but this is a person who rudely let AI perform a task badly which should have been handled by just… merging/rebasing the PR after confirming it does what it should do, then couldn't be bothered to reply and instead let the robot handle it, and then refused to fix the mess they made (making the apology void). That…
What if it's some junior given a job beyond their abilities, and struggling manfully using whatever tools they have to hand. Is it worth publicly trashing their name? What does their name really add to this article?
[deleted]
Re: Okta's NextJS-0auth troubles
#74Earlier quoted context omitted.
> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.
We've recently moved to Auth0. I'm no security expert. Whats the recommended alternative that provides the same features and price, but without the risks suggested here?
If you’re looking for b2b identity, I’m the founder of WorkOS and we power this for a bunch of apps. Feel free to email me, mg@workos.com
Re: Okta's NextJS-0auth troubles
#75Earlier quoted context omitted.
> I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. Oh. Em. Gee. Is this a common take on Okta? The article and comments suggest...maybe? That is frightening considering how many customers depend on Okta and Auth0.
We've recently moved to Auth0. I'm no security expert. Whats the recommended alternative that provides the same features and price, but without the risks suggested here?
Heya, I work for FusionAuth. We have a comparable product for many use cases.
Happy to chat (email in profile), or you can visit our comparison page[0] or detailed technical migration guide[1].
0: https://fusionauth.io/compare/fusionauth-vs-auth0
1: https://fusionauth.io/docs/lifecycle/migrate-users/provider-...
Re: Okta's NextJS-0auth troubles
#76[deleted]
Re: Okta's NextJS-0auth troubles
#77Okta requiring to create a video for a pretty obvious vulnerability shows that Okta does not take security seriously, contrary to what they say at their earnings calls. Sounds like deceiving their investors.
Re: Okta's NextJS-0auth troubles
#78That’s funny. I spotted a similar issue in their Go SDK[1] a few years back. I was pretty appalled to see such a basic mistake from a security company, but then again it is Okta. [1]: https://github.com/okta/okta-sdk-golang/issues/306
Kind of funny that stalebots are the new "won't fix" methodology to ignore security issues with plausible deniability.
Yeah I got a kick out of that. "We might have fixed your issue, if we didn't, open a new one because we took so long acknowledging this one".
Re: Okta's NextJS-0auth troubles
#79Earlier quoted context omitted.
Running your own local AuthN/AuthZ is more than just 'install it on a box in the closet'. I don't blame anyone for letting one of the giants do this on their behalf -- they have the expertise, though I agree I wouldn't touch Okta.
For your average enterprise it really is that simple. Register some IDPs. Connect a backend. Add some clients over time. Yes, you need someone to wear the IAM admin hat. But once you get it configured and running it requires 0.1 FTE or less (likely identical to whatever your Okta admin would be). Not worth 6+ figures a year and exposure to Okta breach risk.
No, it isn't "simple". Protecting your IdP is critical and not easy.
Yes, creating a SAML integration is easy, but that's only one piece of the puzzle.
Re: Okta's NextJS-0auth troubles
#80Earlier quoted context omitted.
While that is true, I feel like it is irrelevant here since it seems like Okta definitely wants (and perhaps needs ) the fixes. God only knows why GitHub still forces it on though. Early on it might've been some mechanism to encourage people to accept contributions to push the social coding aspect, but at this point I have no idea who this benefits, it mostly confuses people when a project doesn't accept PRs.
> Okta definitely wants (and perhaps needs) the fixes They definitely don't want them if their process requires signed commits and their solution is 1) open another PR with the authors info then sign it for them, and 2) add AI into the mix because git is too hard I guess? No matter how you slice it, it doesn't seem like there are Okta employees who want to be taking changes from third parties.
I think that they absolutely still want the free labor. All of those signals just suggest that they're not willing to reciprocate any effort that you put in when you contribute.