samjs

7 ms·

1.
by samjs 5mo ago
Hey James. Thanks for the feedback, and good catch. Looks like that endpoint is pulling from a slightly out of date data source. The docs/dashboard currently are the best resources for the full catalog, but we'll update that API t
2.
by samjs 5mo ago
Hey! I'm one of the engineers who built this :) We'll be adding prices to the docs and the model catalog in the dashboard shortly. In short: currently the pricing matches whatever the provider charges. You can buy unified billing
3.
Building a Rust Crate Summarizer with Workers AI: Lessons Learned(samjs.io)
3 points by samjs 1y ago|1 comments
4.
Rudy: A Toolchain for Rust Debuginfo(samjs.io)
4 points by samjs 1y ago|0 comments
5.
by samjs 1y ago
I've been building tooling for better debugger support for Rust types using debuginfo: https://github.com/samscott89/rudy I'm planning on doing a proper writeup/release of this soon, but here's the
6.
The Proof: Securing Internet Protocol TLS 1.3(tamarin-tls.cispa.de)
2 points by samjs 2y ago|0 comments
7.
by samjs 2y ago
Hey jdenquin, author/Oso cofounder here. I'm obviously biased, but IMO the benefits of using a language over SQL is: * Ability to write reusable logic (rules) * Support for inline policy tests * Abstracted from the data model, so
8.
by samjs 2y ago
Hey all! I'm Sam, cofounder + CTO at Oso. Thank you all for the great discussions going on here. If folks are interested in either learning more about the product or working on these kinds of problems, you can email me directly at sam
9.
by samjs 2y ago
Hey cratermoon, Oso CTO here. I'm probably too close to it, so I'm not following: "a great many of the problems they are solving exist because of RBAC" Oso supports authorization using any combination of RBAC/ReBAC&
10.
by samjs 2y ago
Ah got it, thanks for sharing! That's definitely context I'm missing from having never used it in an actual application.
11.
by samjs 2y ago
> I don't really have much desire to get into maintaining an auth library; there's just not enough time in the day! Haha, well in some ways I'm glad to hear that. That's why we exist :) > It's pending publish,
12.
by samjs 2y ago
Biscuits are really cool, one day I plan to try and convince Geoffroy to integrate Polar for policies :) Currently Biscuits + Polar are ideologically similar but with distinct use cases at the moment. Oso is a central service that your back
13.
by samjs 2y ago
That's a really clean implementation. And the shares are used to resolve authorization here [1], right? Two things that we're solving for at Oso is: making it easier for multiple teams to collaborate on permissions (which we solve
14.
by samjs 2y ago
This sounds really elegant, I love it. Have you seen this deployed in a service-oriented architecture or primarily integrated as part of a single app/db?
15.
by samjs 2y ago
(Oso CTO here). Out of curiosity what do you not like about CASL? It always seemed to have a similar goal in mind which I loved, but I suspect it hit similar challenges we had when replying on ORM integrations.
16.
by samjs 2y ago
Hey simon! Oso CTO here. Definitely one of my favourite problems too! Some additional context for those who don't think about this all the time: in many cases, the solution is as simple as "write some SQL where clauses to do the f
17.
by samjs 2y ago
Quick addition: in practice everyone that I know uses Git + CI/CD for managing + deploying policy changes.
18.
by samjs 2y ago
> However: you seem to target developers. Why do you force me to leave my IDE and use your "rules editor"? Can I not write all those things in my IDE, with all the support it brings, and integrate this into my CICD flow? (yes,
19.
by samjs 4y ago
Hey all! Here's a feature I worked on recently at Oso -- it's a little UI for building example policies combining different authorization features. I thought folks here might like it. It feels like there's been some growing e
20.
Model Your Authorization with the Policy Builder(osohq.com)
6 points by samjs 4y ago|1 comments
21.
Implementing Type Inference for Request Validation(osohq.com)
8 points by samjs 4y ago|0 comments
22.
by samjs 4y ago
Please let me know if you do write something. I would love to read it!
23.
by samjs 4y ago
Nice! Is the request composer responsible for checking the authorization data? Like what roles/permissions the user has?
24.
by samjs 4y ago
Honestly, if your authorization needs are coarse enough that you can (a) handle it as middleware at the controller level, and (b) mostly just rely on roles, then you're probably in a good place to keep going with that! It avoids a lot
25.
by samjs 4y ago
> I just don't see how "allowed to leave an emoji reaction to an issue inside a repository belonging to an organization" could be anything but application logic. I think it's absolutely fair to say that authorization
26.
by samjs 4y ago
Good catch, thanks!
27.
by samjs 4y ago
Thanks epberry!
28.
by samjs 4y ago
Love this article. My favourite part is: > "So the logical thing to do is to implement an authorization service and everybody would be able to use that and keep your precious service boundaries, right? WRONG. Your hell, has just beg
29.
by samjs 4y ago
Well, I potentially have some good news for you :) There are a bunch of companies who popped up in the last few years to solve this problem. We're one of them -- Oso (I'm the CTO). It's definitely a fun/challenging probl
30.
by samjs 5y ago
This is definitely a consideration for authorization. To do it well you need to be able to distinguish when you want to reveal information. For example, our APIs push people towards returning a 404 if the user doesn't have read access

More ›