jschorr

5 ms·

1.
Pulley is shutting down in December(pulley.com)
21 points by jschorr 1d ago|8 comments
2.
by jschorr 2mo ago
The main pain points around using a Zanzibar-like approach (typically called Relationship-based access control) are: (1) The need to write relationships and keep them updated in the permissions database. Often, this requires writing to both
3.
Grafana Labs internal source code accessed(twitter.com)
85 points by jschorr 4mo ago|26 comments
4.
by jschorr 9mo ago
Sweet! I'd love to see it, if you have a link, or throw it in our Discord [1]! [1]: https://discord.com/invite/GBeT3R4k84
5.
by jschorr 9mo ago
Google's Zanzibar actually does both : for the vast majority of queries, it uses significant levels of caching and a permitted amount of staleness [1], allowing Spanner to return a (somewhat stale) copy of the relationship data from l
6.
by jschorr 9mo ago
We actually have users that synchronize their resources from various sources (AWS, Kubernetes, etc) into SpiceDB, explicitly so they can perform these kinds of queries! One of the major benefits of a centralized authorization system is allo
7.
by jschorr 9mo ago
In SpiceDB, this is known as the LookupResources [1] API, which returns all resources (of a particular type) that a particular subject (user in this case) has a particular permission on. We have a guide on doing ACL-aware filtering and list
8.
by jschorr 9mo ago
Dealing with lists is complicated with ReBAC, but possible. See my other comment on this: https://news.ycombinator.com/item?id=45662850
9.
by jschorr 10mo ago
I'd start with reading the Zanzibar Paper. We built an annotated version [1] that provides additional guidance on some of the denser sections and how we interpreted them. Then, I'd take a look at the history of SpiceDB [2] for how
10.
by jschorr 10mo ago
It is actually slightly worse than even that: while New Enemy [1] is the primary concern, caching like this can also introduce a staleness issue from the other direction: let's say a user adds a new row or document, and immediately sen
11.
by jschorr 11mo ago
Happy to answer any other questions :D
12.
by jschorr 11mo ago
> I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates. Yep, as I mentioned above, its not an easy problem but once it is solved for you, it becom
13.
by jschorr 11mo ago
Reconciling externalized authz with search is actually quite a challenging problem. For standard externalized authz, the recommendation is some form of pre-filtering or post-filtering [1], for which we actually built LookupResources (pre-fi
14.
by jschorr 1y ago
We actually originally pronounced it as "kway" (the American pronunciation we had heard) but then had a saying we'd tell customers (when asked) of "pronounce it however you please, so long as you're happy using it!&
15.
by jschorr 2y ago
An amusing story of how I spent my Monday afternoon debugging a failure in our CI that mysteriously appeared over the weekend
16.
The Day Benjamin Franklin Broke Our CI(authzed.com)
6 points by jschorr 2y ago|1 comments
17.
AMA on X with Boom CEO Blake Scholl(twitter.com)
2 points by jschorr 2y ago|0 comments
18.
Open sourcing the SpiceDB Playground: model authz in-browser, powered by WASM(authzed.com)
5 points by jschorr 2y ago|2 comments
19.
by jschorr 2y ago
Hi HN, I'm happy to announce the open sourcing of the SpiceDB Playground [1], our in-browser playground for developing and testing authorization systems for SpiceDB, our open source implementation of Google Zanzibar. In a previous HN p
20.
by jschorr 3y ago
Definitely! We ourselves, in fact, use SpiceDB for our own dynamic feature flags internally.
21.
by jschorr 3y ago
"Can I [action]?" is the exact question that Zanzibar[0] was designed to answer in a highly performant and scalable way. With multiple data sources reading and writing to SpiceDB [1] (our OSS implementation of Zanzibar), those que
22.
by jschorr 4y ago
Indeed it is! :)
23.
by jschorr 4y ago
Zanzibar is an authorization system Google built and describes in a paper [1], which uses relationships to make authorization decisions (aka ReBAC): if there exists a path of such relationships between a resource's permission and, say,
24.
by jschorr 4y ago
If you're curious to see a Postgres-based implementation, SpiceDB has a Postgres driver: https://github.com/authzed/spicedb/tree/main/internal/datast...
25.
by jschorr 4y ago
Exclusion (and intersection as well) provide for some very powerful computation primitives, with only a slight overhead in performance. In addition, there is `tupleset_to_userset` [0], which can be thought of as an arrow (which is also how
26.
by jschorr 4y ago
All custom but fully open source! Code can be found at https://github.com/authzed/zanzibar-annotated
27.
by jschorr 4y ago
Yep! Groups can be easily nested under one another by simply creating a relationship between the group's members and the members of another group. In SpiceDB [0] schema this can be represented like so: definition group { relati
28.
by jschorr 4y ago
Author of the post :) I did actually briefly look into it! I was hoping it would work for us, but the first time I tried to perform the compilation with it, it failed due to issues with support for at least one of the dependencies we bring
29.
by jschorr 4y ago
The problem you're describing is sometimes called the "ACL Aware Indexing" problem [1]. In a permissions service based on Zanzibar, this can partially be solved by walking the permissions graph in a reverse fashion: SpiceDB e
30.
by jschorr 5y ago
Disclosure: I'm also a founder of Authzed The information you are describing can be retrieved via the Expand API [0], which returns a tree containing all of the relationships that are reachable from a permission, as well as how they we

More ›