geal

10 ms·

1.
by geal 2y ago
Biscuit maintainer here o/ There's definitelt some cool use cases we could collaborate on. One thing I'm looking at more deeply right now is tokens carrying the necessary data as they go through the system,to make sure one ca
2.
by geal 3y ago
(biscuit author here) I tried a lot of different formats, especially looking for something that generated small tokens, that could have a canonical form, and that was supported in a lot of languages. The canonical part was a dead end as mos
3.
by geal 3y ago
check if: if any one of those fails, the entire authorization fails allow if/deny if: they are tried in order, we stop at the first that matches. If an allow if matches and all checks passed, then the request is authorized
4.
by geal 3y ago
oh and for OAuth, it can integrate well with it: https://www.biscuitsec.org/blog/oauth-oidc/
5.
by geal 3y ago
(biscuit author here) you caught me, I can't help getting excited about the project XD > Given a long-term token, can I create short-term, auto-expiring tokens? yes, with attenuation: https://doc.biscuitsec.org/recip
6.
by geal 3y ago
(Biscuit author here) there is some support for revocation with the way revocation ids are implemented: there's one generated for each block of a token, so if you add the token's last block's revocation id to the revocation l
7.
by geal 3y ago
there's a siimilar concept in Biscuit, the 3rd party block: https://www.biscuitsec.org/blog/third-party-blocks-why-how-w... It's not advertised a lot right now because it's not supported by all libraries
8.
Token revocation(biscuitsec.org)
105 points by geal 3y ago|34 comments
9.
by geal 3y ago
It is very much intended :D
10.
by geal 3y ago
No standardization for now, as we were still exploring the model. The spec is carefully built for evolution though, providing backwards compatibility where possible. The main developers are Clément Delafargue, maintainer of the Haskell vers
11.
by geal 3y ago
This is not a cryptocurrency technology,it was designed with microservices authorization in mind, inspired from JWT and macaroons. I have looked at cryptocurrency related tech earlier though (pairing libs from zcash, gamma signatures), beca
12.
by geal 3y ago
PASETO is great! It's way better than JWT, for the use cases targeted by JWT. Biscuit explores other use cases, like attenuation
13.
by geal 3y ago
Right, we forgot to add the context on this release, thank you for the feedback!
14.
by geal 5y ago
(biscuit author here) I like how that post points a crucial issue in authorization systems: how powerful and flexible should we make them? If you go towards flexibility, you get more complexity and possibly unexpected results. And they beco
15.
Use Datalog to write your authorization rules(clever-cloud.com)
4 points by geal 5y ago|0 comments
16.
Biscuit: Pubkey signed token with offline attenuation and Datalog authz policies(clever-cloud.com)
2 points by geal 5y ago|0 comments
17.
Nom 5: fast Rust parser combinators, now without macros(unhandledexpression.com)
2 points by geal 7y ago|0 comments
18.
Why you should, actually, rewrite it in Rust(unhandledexpression.com)
8 points by geal 9y ago|0 comments
19.
by geal 9y ago
We in fact tested multiple languages. I can even point you to various works done at the ANSSI like https://github.com/ANSSI-FR/bootcode_parser (python) or https://github.com/ANSSI-FR/caradoc (OCam
20.
by geal 9y ago
(one of the authors here): parser generators are generally good for one thing: parsing programming languages. For more complex formats, where you have to carry state around, or binary formats, they're extremely cumbersome to use. I oft
21.
Async, Futures, AMQP, pick three(clever-cloud.com)
10 points by geal 9y ago|0 comments
22.
Security is a process, not a reaction(clever-cloud.com)
8 points by geal 10y ago|0 comments
23.
by geal 11y ago
thanks!
24.
Nom, the fast Rust parser combinators library, just reached 1.0(clever-cloud.com)
10 points by geal 11y ago|2 comments
25.
by geal 11y ago
does it provide ordering and transcript verification, even in case of partition and resume? I know that XMPP is meant to handle that kind of stuff reliably, but a multiparty OTR or Axolotl ratchet should make sure that even if the transport
26.
Crypto problems you actually need to solve(unhandledexpression.com)
118 points by geal 11y ago|37 comments
27.
Crypto problems you actually need to solve(unhandledexpression.com)
1 points by geal 11y ago|0 comments
28.
Comparing akka-stream and scalaz-stream(softwaremill.com)
1 points by geal 11y ago|0 comments
29.
PeaCoq, a UI for Coq(goto.ucsd.edu)
93 points by geal 11y ago|8 comments
30.
by geal 11y ago
That new git server is so fast, it finished before you started it! More seriously, the performance improvement here is really significant

More ›