adeptima

https://datatracker.ietf.org/doc/html/draft-ietf-gnap-core-p...

And by the way, has anyone researched on GNAP (published 20 March 2024)?

> GNAP (Grant Negotiation and Authorization Protocol) is an in-progress effort to develop a next-generation authorization protocol

From spec https://oauth.net/gnap/

> GNAP is not an extension of OAuth 2.0 and is not intended to be directly compatible with OAuth 2.0. GNAP seeks to provide functionality and solve use cases that OAuth 2.0 cannot easily or cleanly address.

> GNAP and OAuth 2.0 will likely exist in parallel for many deployments, and considerations have been taken to facilitate the mapping and transition from existing OAuth 2.0 systems to GNAP

Doesnt look like GNAP will fly any time soon, however there is a very interesting part - Security Considerations section. Looks like it was made by people who are familiar with all varieties of cyberops and usability issues in OAuth2/OIDC spec.

Security Considerations section

If any cyberops, pentester pro reading this, please advise how to research more. Thanx in advance.

Thanx for sharing!

What if pre-signed URL is leaked, you cannot invalidate a pre-signed URL without rotating credentials or changing bucket policies, right?

I was thinking about signed cookies or API gateways type of solutions.

> Some specs should be mandatory 100% agree

OpenID Foundation seems took a path of making "profiles" like FAPI rather consolidation and enforcing the best practices and depricating the bad.

FAPI (Financial-grade API Security Profile 1.0) https://openid.net/specs/openid-financial-api-part-1-1_0.htm...

I hope the community will combine it all at some point and add specifications for proper policy and resources management too by looking at the full lifecycle of modern applications.

my guess the idea and intension of .well-known was good, so generic end-user libraries can be implement ... the reality is ugly and generate lot of man hours for cyberops consultancies

And this is why OIDC and IDPs exists to expand more with nonce, user agent footprints and other validation mechanisms

Expand to OIDC and use session based mechanism with some kind of policy engine?

Never saw a good example of how to implement a proper access to pdf or other downloadable documents.

What is your approach? Any good code base in open source to learn from?

https://www.youtube.com/@saschazegerman/playlists

Excellent writing and diagrams!

If you want to expand your knowledge beyond OAuth2 (and most probably you should if you want to design systems used by big guys from 0 to 1) , highly recommend to jump straight into OpenID Connect (OIDC) which is an identity layer built on top of OAuth 2.0.

Besides reading specs, Sascha Preibisch's videos on both OIDC and OAuth2 were the most useful to solidify a bigger picture for me

Specs are actually well written despite of all jargon and train of buzzwords used inside. The most annoying on my list are OP (OpenID Provider) and RP (Relying Party) ...

https://openid.net/specs/openid-connect-core-1_0.html

https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/

Most useful knowledge however personally gained from studying ORY Hydra mentioned in the article and Zitadel

https://zitadel.com/

The problem with OIDC and OAuth2 space - IDP providers are too "creative" in their interpretation of specs starting from userinfo and token exchange endpoints.

Without allocating significant amount of time getting all flows and related cyberops into your brain might never happened.

Good news - it's a life time investment ...

Oidc search on github gives good results - libraries, open source IDPs, all kind of proxies, etc

https://github.com/topics/oidc

adeptimaon Thank HN: My bootstrapped startup got acquired today

Inspiration for all of us. Congrats!

adeptimaon Startup Winter: Hacker News Lost Its Faith

Feeling the same pain of walking through the creator's hell.

Heard somewhere we are not supposed to be happy and absent minded. Staying on hard side of things shapes us and make complete.

I'm not sure if this helps, but I’ve personally stopped stressing about outcomes, "get rich quick" schemes, or being in the perfect moment.

The journey is what truly matters.

I use my own tools for consulting and eventually outsource myself as needed. If clients want to hire someone else, I don’t resist. I simply ask for two or three months’ salary for training and limited support afterward.

I’m not trying to build something worth millions to sell. I used to sell CRMs built on top of WordPress for a long time. Eventually, it evolved into a CRM I now use across several businesses. Over the years, I’ve also created numerous small tools that I’ve been using for over a decade—tools for tracking trends, education, and more.

I don’t aim to be in the top 5% of earners, just be in the middle for targeted niche is ok.

For me, freedom means working in "Pendulum mode"—six months of active client phases followed by six months of prototyping new ideas. That balance keeps me sane. No conflict of interests. Clients know I worked hard to kick off things, and productive than most other engineers in slow mode.

As for pressure of being update - I made a simple commitment to try new things 4-8 hours a week min. AI, ML, K8s, hyped programming languages. It was brutal at the beginning, and extremely joyful process now. It's getting easier and easier. The main motivation is to be connected with folks who will come after me.

I'm also trying to surround myself with builders, and be less with transactional people who simply wants salary. Helping other to overcome and internalize the essence of pain of owning code and full responsibilities make my struggles easier.

One thing I would never sacrifice for being in a creator mode - wellbeing and needs of my family. Whatever it takes to bring the food on the table. All high purposes come after.

Naval's mega episodes help me to settle things in mind really well too

wealth https://nav.al/rich

happiness https://nav.al/happiness

health https://nutritionfacts.org/daily-dozen-challenge/

https://www.youtube.com/watch?v=Gk-9Fd2mEnI&t=184s

I knew the guy who worked with Jobs and hated him with passion.

Let's keep the useful image parts.

“How many of you are from manufacturing companies?”

[Some hands go up.]

“Oh, excellent. Where are the rest of you from? Okay, so how many are from consulting?”

[A number of hands go up.]

“Oh, that’s bad. Yeah, the mind is too important to waste—you should do something.”

“I think that without owning something over an extended period of time—like a few years—where one has a chance to take responsibility for one’s recommendations, where one has to see those recommendations through all action stages, accumulate scar tissue for the mistakes, pick oneself up off the ground, and dust oneself off, one learns only a fraction of what one can.”

Wow, great roadmap! Will decomposition more. Thank you

Thnx for input! Will check video!

Noted on ATX West show. Thank you!

Had a recent conversation with nephew about his robotics study, and it seems he’s overwhelmed with ROS, OpenCV, Python, AI transformers tutorial hell.

Told him we should go together to industrial expo - starting from 3d printing, molding, material science and robotics and spend some time together to hack into hard core C++ SDKs used by big tech like Nvidia and Co, and look how to developed linear algebra and statistic on real life examples.

His dream is to automate small mid business manufacturing, and become a Steve Job like figure one day.

What’s the good information and resources to follow and educate about real life robotics?

Any tips or even sarcastic comments are welcome. Please help to be a cool uncle ;)

Still better time spend than doing leetcode.

It's my go-to argument against leetcode style interviews.

I would rather ask a candidate to spend 30 mins and do research together on collaborative editing, or visualizing distances used in pgvector or similar vector database.

Imagine how far the whole colabarative editing space moved forward if 1% of leetcode grinding were rerouted

https://github.com/yjs/yjs/blob/main/src/utils/encoding.js

Same experience. Go is my default choice for backend too

It can easily be a full time job

You need to mirror all logic and encoding/decoding part

https://github.com/yjs/yjs/commits/main/src/utils/encoding.j...

I was thinking about spining off nodejs instance just for persistence and syncing with postgres

Thank you. Keep going. Very good topic to expand