orweis

5 ms·

1.
AI Slop or quality storytelling? – Dune themed MCP Gateway tutorial [video](youtube.com)
1 points by orweis 6mo ago|0 comments
2.
by orweis 2y ago
Nice! Thanks for the share - I'm Or one of the founders or Permit.io. Happy to answer any questions.
3.
by orweis 2y ago
Thanks a ton for the mention, and hope you like it. If you haven't also check out our video: https://youtu.be/JMzr21rnBes Fine-grained authorization is becoming a staple, we hope to make not just building but also usin
4.
by orweis 2y ago
Or Weis, CEO at Permit.io here. For the last three years, we have all seen a huge spike in developers implementing fine-grained authorization. Whether they choose the Google Zanzibar implementation or the OPA/Cedar policy approach, it
5.
Show HN: A No-Code UI for Managing Google-Zanzibar Style ReBAC
8 points by orweis 3y ago|0 comments
6.
Developer defies Samsung and Google, launches project to connect WearOS to iOS(merge.watch)
5 points by orweis 3y ago|0 comments
7.
by orweis 3y ago
Hi! Fair point. We got two articles coming this month: RBAC vs ReBAC, and RBAC vs ReBAC vs ABAC - we'll post those here / in the article itself when ready. For now, in short: RBAC (Role based) is a simple identity to role to perm
8.
by orweis 3y ago
Agree 100%. <3 And as I told Joey many times - I'd love to collaborate more with you as well.
9.
by orweis 3y ago
Re: "Graphical" - I can see how that would have that effect :) To be fair it doesn't really say that, it reads:"Graph-based authorization systems utilize a graphical representation to illustrate relationships between use
10.
by orweis 3y ago
Jimmy I truly think you're awesome (And so is SpiceDB), but the irony here stands out: "it presents opinion without any evidence or examples to justify the claim and concludes it as fact" You mean stuff like: 1) "SpiceDB
11.
by orweis 3y ago
In Zanziabr - The article refers to OSS implementations like SpiceDB or Ory. It's a follow-up to a more in depth article (1), trying to be a lighter read starting point. - 1: https://www.permit.io/blog/zanzibar-vs-
12.
by orweis 3y ago
Founder of Permit.io here- cool that this article grabbed some love. For those of you not sure which is the best from the article- Permit combines all 3 together. - OPA/REGO or Cedar at the edge, for quick efficient and zero latency po
13.
by orweis 3y ago
That's exactly what OPA does (Datalog), and what OSO do (Prolog)
14.
by orweis 3y ago
Hi jzelinskie, Or from Permit here - The overall tone of your reply here reads as furious to me ,so I'd like to apologize for offending you, I tried to provide a balanced analysis here- and I think you'd agree it's a tough to
15.
by orweis 3y ago
BTW another differentiator we offer- is our low-code policy editor that write Rego or Cedar directly into Git for you (And your non-technical team members) Supports RBAC, ABAC - and next month ReBAC https://docs.permit.io/fe
16.
by orweis 3y ago
Or from Permit.io here :) - we support OPA, Cedar, as well as Amazon Verified Permissions, and we'll be coming out with more soon. Both in Permit.io and in OPAL 1 Graham from OSO (gneray) - just didn't see the recent news, I gues
17.
Authorization still tops OWASP top API Security risks for 2023(permit.io)
2 points by orweis 3y ago|0 comments
18.
by orweis 3y ago
True a gating reverse proxy isn't a new idea- but combining it with frontend only login, policy as code, and secrets injections from a vault to produce authorization you can use seamlessly from the frontend kinda is ;-) As asafc mentio
19.
by orweis 3y ago
:D Truly? So does that mean you won't use any cloud service (e.g. AWS, GCP, Azure) ? And no Authentication services (e.g. Auth0, AWS Cognito, Firebase)? ...
20.
by orweis 3y ago
In a sense you do own it, you just delegate it, and thanks to JWT and JWKs you control the identity flow. Meaning, you don't have to physically be the guard at the door, to know your door is guarded. And you can use passports and well
21.
by orweis 3y ago
You are correct (As this is a generic component), but kinda missing the point ;) In the backend - you don't need this - there are already solutions you can consume for authorization (OPA, AWS Cedar, Permit.io, ...) But in the frontend
22.
by orweis 3y ago
Of course you need identity (FoAz uses JWTs from authN solutions - can also be your VM (if it produces a JWT as it's magic link process)) , but Authorization is another step on top. e.g. You are Dave@customer.io (or some other verified
23.
by orweis 3y ago
That sounds more like Authentication (verify identity) than Authorization (decide specifically what they are allowed to do per request), no?
24.
by orweis 3y ago
Yep, checkout the BYOD page: https://foaz.io/use-foaz/byod Reverse-proxy + Policy-as-Code-Engine + Secrets Vault == FoAz
25.
by orweis 3y ago
It's actually a good question :) It is the backend - but a generic backend as opposed to a specially tailored open per case. To clarify - FoAz is frontend only - like Serverless has no servers :D The idea is that as a FE developer you
26.
by orweis 3y ago
Hi HackerNews, Or from permit.io here, happy to discuss and answer questions here about the concept of FoAz and its RFC.
27.
Show HN: Front end-Only-Authorization – A new web standard(foaz.io)
43 points by orweis 3y ago|23 comments
28.
Show HN: Run AWS Cedar Policy Like OPA(github.com)
4 points by orweis 3y ago|0 comments
29.
Show HN: Cedar Policy Agent – Run AWS Cedar Like OPA(github.com)
2 points by orweis 3y ago|0 comments
30.
by orweis 3y ago
I agree with you re:"I wouldn't say Cedar is directly competitive as SpiceDB" - I think Zanzibar and SpiceDB in particular can work well together with Cedar / OPA. By syncing SpiceDB via OPAL[0] into edge nodes with Ceda

More ›