vwpolo3

18 ms·

1.
Show HN: Ory Kratos, an open source Auth0 / Clerk alternative(github.com)
2 points by vwpolo3 10mo ago|0 comments
2.
GitHub Action's “Approve Run” is broken(github.community)
1 points by vwpolo3 5y ago|0 comments
3.
by vwpolo3 5y ago
That looks like a mistake in the doc: - https://oauth.net/articles/authentication/ - https://tools.ietf.org/html/rfc6749 - The OAuth 2.0 Authorization Framework
4.
by vwpolo3 5y ago
It explains why OAuth2 is hard to use and does not solve login, registration, sessions, profile management, mfa, and proposes another solution. It’s all open source! :)
5.
by vwpolo3 5y ago
The first vulnerability is in the title, OAuth is an Authorization framework (Open Authorization) and is explicitly NOT for authentication. It’s also a delegation protocol (I give you something to do on my behalf). If you want a list of thi
6.
by vwpolo3 6y ago
Don't forget Ory: https://github.com/ory
7.
by vwpolo3 6y ago
There are already true open source alternatives on the horizon such as https://github.com/ory It is about time for a new generation of identity systems in my opinion. This acquisition shows the risk of centralized, vendor l
8.
Show HN: Historical Download Statistics for All Public Docker Hub Images(dockerstats.com)
1 points by vwpolo3 6y ago|1 comments
9.
by vwpolo3 6y ago
Don't implement your own, there's tons of open source that can do that, for example https://github.com/ory/hydra
10.
by vwpolo3 6y ago
Without upgrade, this might be exploited through package managers able to fetch from Git URLs (so NPM, Go Modules, and others).
11.
Malicious URLs cause Git (v2.26.0) to present stored credentials to wrong server(github.com)
29 points by vwpolo3 6y ago|2 comments
12.
Docker Hub download count maxes out at 2.1bn (int32)(github.com)
2 points by vwpolo3 7y ago|0 comments
13.
by vwpolo3 7y ago
Ory | Open Source Software Engineer (Go, React) | FULLTIME | ONSITE in Munich Germany We build stuff for an emerging cloud infrastructure. It's security, zero trust, hardcore bullet proof engineering. It's Golang, K8S, React, Hash
14.
by vwpolo3 7y ago
The problem is that online news sources are (almost) all the same - low budget, second tier silos of mostly trainee journalists. They have an emphasis on clicks and outrage and constant updates to keep you engaged and are a secondary (or te
15.
by vwpolo3 7y ago
Username + Password with a cookie store is much better understood and harder to get wrong than implementing a full OIDC suite (server + client). If you're talking federated login, that's what OIDC is for. If you're talking &q
16.
by vwpolo3 7y ago
Sorry, but following a standard for federation is not a substitute for building a log in system, which is what most people want when building "a web app".
17.
by vwpolo3 7y ago
Yes, not only on a roadmap but in high priority and under active development (not in the public eye yet)
18.
by vwpolo3 7y ago
The blog posts and discussion was long ago (the video is 6 years old). Since then, that particular author acknowledged that (iirc) OpenID Connect solves many of the things he criticized. I have to look up the source, it’s been a while. Howe
19.
by vwpolo3 7y ago
Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete or insecure implementations. If you’re greenfield, OAuth2&#x2
20.
by vwpolo3 7y ago
While not explicitly mentioned, PKCE is supported! And yes, that draft was an important guide during implementation.
21.
by vwpolo3 7y ago
It leaves the implementation of the login (enter /password, ...) and consent (may application X have access to your pictures?) flows up to the developers using HTTP Redirection flows. You can therefore integrate it much easier in exist
22.
Show HN: Hydra – Open-Source OAuth2 Server(gethydra.sh)
190 points by vwpolo3 7y ago|51 comments
23.
by vwpolo3 7y ago
Agreed, also while they can not be censored by the administrator of the website, they can still be censored (or moderated) by the Plugin Owner, right?
24.
by vwpolo3 8y ago
The open source ory ecosystem ( http://github.com/ory/ ) might have what you're looking for, but it's definitely for advanced usecases. I know a lot of people that worked with Auth0/Okta/AWS Cognito