Hacker News Reader

Am I the only one who thinks the initial PHP example is just fine?

Seriously, you're claiming to "solve" one "problem" by building an entire new system which is inevitably massively more complex and difficult to manage than the "problem" you're trying to solve.

Then again, I don't work in enterprise-level environments but to be honest if this is what it's like, I'm glad I don't.

View on HN

Works fine for 1 application, but what about for thousands of services with many teams?

Everything is difficult with scale. We can’t expect every service owner to implement authz correctly, but if we can expose and build tools that help standardize and abstract as much as possible the difficulties of authz then service owners can focus their energy on other things.

If it’s fine, you can consider yourself lucky. Authentication and authorization complexity is IME squarely proportional to system and organization size due to network effects inside them. At some point it becomes a significant subsystem in itself and contrary to belief of some it becomes a core business problem, not a checkbox to tick off.

Reply on news.ycombinator.com