11 ms·
Authorization terminology is a mess: Let's fix it
- tuberreact 13d agoturns out naming is important
- andai 13d agoI'm maintaining a document called Tricksy words with multiple meanings that cause endless confusion and strife Just in the past year I have wasted several months pulling my hair out due to incorrectly named projects. It really does turn out naming is important!
- rrr_oh_man 13d agoCare to share some highlights?
- andai 12d agoForgive me this long list, I hadn't the time to make it short! Function: a mapping from inputs to outputs, vs "a chink of code that runs and does arbitrary things with global state." Some languages resolve it by using the word procedure (and keyword proc). (For an amusing read on this subject, see Chapter 5 of Let Over Lambda, which argues that Lisp is actually the least functional language!) Deserve: can refer to unconditional rights, as well as conditional privileges. (e.g. "every child deserves a safe home", vs. "this person deserves to be punished.") Positive/Negative have at least 3 separate meanings depending on context (good, present, self-amplifying). e.g. positive feedback can means the system is about to explode, positive symptom can mean "CIA replaced my Shasta again". Normal can mean "happens all the time" or "is acceptable". Often those two are not in agreement. (People often fuse this one. If it's unusual then it must be bad! If it's common then it must be okay!) Meaningful: something "means" something if it points beyond itself (as a symbol), or if it doesn't (direct experience). Example: enjoying a sunset The experience itself can be deeply satisfying. Or you can project ideas onto it like "I'm blessed", "I earned it", so the experience "points beyond" itself. (Alan Watts has an excellent video on purpose and meaning, considering our approach to them a uniquely western neurosis.) Serious: committed, vs overly heavy. People often confuse the two attitudes, which creates a lot of inner resistance. (And ironically produces childishness due to resistance to maturity.) Selfish: prone to neglect others (bad), vs taking care of yourself (good and natural to every organism, yet often vilified in our culture). You can do both of course but they're kind of independent axes. Several authors have written in defense of selfishness, but were so abrasive that they did the idea more harm than good! Meditation can mean 10,000 different things, many of which are opposites (e.g. intentionally directing the attention, vs allowing it to wander freely). (Enlightenment is similarly open to interpretation, even within the same school of thought!)
- simonw 13d agoI've worked at places where it turned out different parts of the organization had a different idea of what a "user" of the core product was. The team using Salesforce, the data warehouse team, the application development teams, all with different mental models of what "we added 5,000 users today" actually meant in concrete terms.
- jcdreads 13d agoOh man. This gets really exciting when in addition the Finance team has to tell the SEC how many active users there are, but they're using different definitions every quarter because they get their numbers in some non-reproducible way from whichever of those other teams has time to help them this month. Source: my own years on data warehouse and application development teams.
- ptman 13d agoI've seen a spreadsheet with NATO abbreviations and terms. It's tens of thousands of entries. And the best ones have tens of definitions.
- ithkuil 13d agoAnd renaming things is hard, if not impossible
- bijowo1676 13d agoexcellent article, very thorough and nuanced explanation.
- andychiare 13d agoThanks!
- black_knight 13d ago> can this subject perform this action on this object? IMHO, the most elegant method to answer this question is capability based access control. If the subject can utter the action, then it can perform it. And then delegation is the transfer of nouns and verbs to perform the utterances.
- deleted 13d ago[deleted]
- simiones 13d ago> If the subject can utter the action, then it can perform it. This sounds like another layer of weird terminology that doesn't mean anything for someone who is not familiar with whatever capability system you're thinking of. Say I am a user who can see a particular directory on a shared setup. I try to upload a file in this directory, using the same method that worked on another directory. The question of AuthZ is: will I be allowed to do it or not? In the plain sense of the words, I can absolutely "utter the action", I have all of the "verbs" (upload) and "nouns" (the file, the destination path). Still, I should not be allowed to perform the action if I was only given read-only access here. Now sure, you can say that "upload to dirA" is a different verb than "upload to dirB". But this is just confusing terminology, it doesn't enlighten anything.
- black_knight 13d agoYou seem to understand it just fine. Your accessor, dirB, should not contain the “upload files” verb, while your dirA accessor (noun) should. My favorite example is the home directory and the file picker. Why should a program have access to all your files by default then politely ask you which file it should read/write to? It would make more sense if the file picker was something the operating system ran when a program wants to edit a file, and what came back to the program after you selected was the accessor for that file (with read and/or write verbs). So the program only have access to those files you have it access to. It cannot even ask the question to open another file, because it only has opaque accessors to those files it has been given.
- Quarrelsome 13d agoNice! I'd like to fix the prior abstract. Auth and auth upsets me greatly cos we have: Authentication & Authorization and we call both/either auth. Hence please help me make this a thing: AuthENTIcation & AuthORIzation : ENTI & ORI ENTI- can you enter, ORI (or ORIZ) what can you do?
- hobofan 13d agoThis has already been solved well-enough with AuthN and AuthZ as distinct names.
- rrr_oh_man 13d agoUK is rotating in its decaying royal grave
- zobzu 13d agopeople still dont understand the difference. "you do iam but what about controllong access" comes in all the time. words dont really matter all that much. people use them because it makes them sound like they know what it is, and if its important and complex, usually have no clue. ive seen enough "abac" where the attribute is "your login name"
- Quarrelsome 12d agoI have literally never seen anyone ever use those terms and also note they both truncate to Auth. Never change programming/maths in holding onto terrible naming conventions and making really hard stuff even harder to understand (CQRS anyone?)
- usernametaken29 13d agohttps://xkcd.com/927 https://xkcd.com/927 Nice work and all regardless
- aneutron 13d agoQuite literally the first thing that jumped to my mind when I read the title
- bayindirh 13d agoAnother take I like is "The good thing about standards is there are many to choose from!"
- andychiare 13d agoJust to clarify, it's not about a new standard, folks. It's about giving things names to avoid confusion and mixing up different things.
- usernametaken29 12d agoWhich is precisely, a standard
- whazor 13d agoIs the article inventing any new words?
- andrewshadura 13d agoUnclosable cookie banner. Top notch website engineering.
- zero_shift 13d agoWould you like cookies? (No) -> You can revoke consent at any time (Revoke) -> Would you like cookies?
- 010101010101 13d agoIt’s about 20% of the vertical screen space on an iPhone, maddening.
- aleqs 12d agoI see no banner, but I use an ad blocker configured to reject and hide all such banners, like a sane person.
- jiggawatts 13d agoI love how the OIDC standard is littered with “authentication identity token code id cookie identifier” and many subtle variations of homonyms in slightly different combinations and orders. I’m sure someone thought it all made perfect sense. Probably someone who never confuses “empathy” and “sympathy” while also carefully distinguishing between “should” and “ought”.
- theasisa 13d ago> Probably someone who never confuses “empathy” and “sympathy” while also carefully distinguishing between “should” and “ought”. What do you mean by this?
- throwaway1058 13d agoI feel "ought" is stronger and is something that is expected of you, but English is not my native language. "You should drink more water" "You ought to help your sick mother"
- da_chicken 13d agoI'm a native speaker and I agree. "Ought" can connote an obligation or responsibility of some sort. "Should" is used more often when the outcome is out of any control. It might only be the speaker's belief. But there is significant overlap.
- zobzu 13d agoim not a native speaker and these always made perfect sense to me :(
- rzzzt 13d agoThat's when you turn to the RFC2119 all-caps requirement levels!
- actionfromafar 13d ago
- erlich 13d agoWhat is missing is a graph of all the data and its relationships. Then its just a matter of grouping things together appropriately for humans to understand. It's funny how a graph underlies absolutely everything but no one seems to use them.
- zbentley 13d ago“It’s worth being honest about…” yeah, no.
- rimworld 13d ago[dead]
- kalayciburak 13d ago[dead]
- nekusar 13d agoAre you fixing it at the IETF and RFC level, or is this just another way to say "BUY OUR SHIT AND IT TOTALLLY SOLVES EVERYTHING!!!!11"
- fmajid 11d agoUsually vendors fight over terminology because they want to "own" a portion of mindspace. Ultimately authorization is a programming problem, and people have devised very complicated declarative solutions like Google Zanzibar to avoid biting the bullet.