Thanks. What would you want to us to write about next?
197 karma · joined February 15, 2018
"Can this user do this thing given these constraints?" or even "Show me all the things this user can do given these constraints"
Our team is solving for this use case. While we focus a lot on abstractions, APIs, etc. that are appropriate for our use case, under the hood everything is driven by an embeddable logic language that we write in Rust, called Polar: https://docs.osohq.com/reference/polar.html
OPA is one solution that's emerged in recent years. The author describes his team's point of view after evaluating it for their purposes.
Oso (https://www.osohq.com/) is a framework for application authorization. Disclosure: I'm a cofounder. Based on the post, the Carta team started their work in 2019, but we only open sourced Oso mid-2020, so they wouldn't have known about it.
And in the last few months, a few other companies have announced offerings to address this problem too.
So it's understandable why Carta chose to build. Now/soon other teams like them should have more options to choose from when they encounter similar challenges too.
- Shiro covers authorization, plus authentication, session mgt, etc. The Carta project is authorization only
- Shiro relies on external data to make authorization decisions. The Carta project stores that data internally
- Shiro is run as part of your app. The Carta project is run as a separate service
- Related: Shiro is specific to Java.Full disclosure: I'm cofounder/CEO of Oso (https://www.osohq.com/), a library for authorization. Overall, it's incredible to see all the activity around authorization recently.
Over the last 15 years, companies like AWS, Stripe, and Twilio have helped developers offload anything not core to their apps so they can focus on what matters to their users. Despite a lot of progress in developer tooling, most developers still roll their own authorization.
You might start with something quick 'n dirty – some IF statements and roles in a database, which may not be pretty but gets the job done...until you need to add more features, and more features. And inevitably every team band-aids onto this system until they do a big refactor. This is lost time for an area that's not core to what most companies are trying to solve for their users, and what's more, no one on the team is feeling great about this work.
At Oso (backed by Sequoia), we're building the first batteries-included library for authorization so developers don't have to roll it on their own ever again. We're designing slick APIs to cut down the amount of time they spend getting their system set up, and building a fully-fledged policy engine and programming language (in Rust) under the hood to ensure they can customize their system however they need. We don't have any product managers – the engineers on the team are responsible for taking broad problems, experimenting with potential solutions and shipping a superhuman experience for our users.
The team members who join now will not only have a disproportionately large impact on the product, but also on the culture and future of the company.
We are based in NYC and hiring folks remote or onsite.
To apply, please visit:
- Software Engineer: https://www.osohq.com/jobs/eng
- Developer Advocate: https://www.osohq.com/jobs/dev-advocate
- Engineering Manager: https://www.osohq.com/jobs/eng-mgr
Oso (backed by Sequoia) puts security in the hands of the makers. We're doing this by delivering security as code, or as Charity Majors (cofounder & CTO of Honeycomb) put it, "Consumer-quality developer tools" for security (https://twitter.com/mipsytipsy/status/1288326027001782273) – beginning with a batteries-included library for authorization.
We open sourced Oso last summer, and the feedback has been amazing. We are hiring folks who want shave down the time developers have to spend thinking about things like roles and route authorization. We spend the bulk of our time building the Oso policy language, Polar, and libraries on top of it. We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. The team members who join now not only have a disproportionately large impact on the product and the community, but also on the culture and future of the company.
We are based in NYC and hiring folks remote or onsite.
To apply, please visit:
- Software Engineer: https://www.osohq.com/jobs/eng
- Developer Advocate: https://www.osohq.com/jobs/dev-advocate
- Engineering Manager: https://www.osohq.com/jobs/eng-mgr
Oso (backed by Sequoia) puts security in the hands of the makers. We're doing this by delivering security as code, or as Charity Majors (cofounder & CTO of Honeycomb) put it, "Consumer-quality developer tools" for security (https://twitter.com/mipsytipsy/status/1288326027001782273) – beginning with an open source policy engine for authorization.
We open sourced Oso last summer, and the feedback has been amazing. We are hiring folks who want shave down the time developers have to spend thinking about things like roles and route authorization. We spend the bulk of our time building the Oso policy language, Polar, and libraries on top of it. We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. The team members who join now not only have a disproportionately large impact on the product and the community, but also on the culture and future of the company.
We are based in NYC and hiring folks remote or onsite.
To apply, please visit:
- Software Engineer: https://www.osohq.com/jobs/eng
- Developer Advocate: https://www.osohq.com/jobs/dev-advocate
- Engineering Manager: https://www.osohq.com/jobs/eng-mgr
NB I'm surprised that anything from Forrester made it on here but kudos to them.
oso (backed by Sequoia) puts security in the hands of the makers. We're doing this by delivering security as code, or as Charity Majors (cofounder & CTO of Honeycomb) put it, "Consumer-quality developer tools" for security (https://twitter.com/mipsytipsy/status/1288326027001782273) – beginning with an open source policy engine for authorization.
We open sourced oso last summer, and the feedback has been amazing. We are hiring folks who want shave down the time developers have to spend thinking about things like roles and route authorization. We spend the bulk of our time building the oso policy language, Polar, and libraries on top of it. We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. The team members who join now not only have a disproportionately large impact on the product and the community, but also on the culture and future of the company.
We are based in NYC and hiring folks remote or onsite.
To apply, please visit:
- Software Engineer: https://www.osohq.com/jobs/eng
- Developer Advocate: https://www.osohq.com/jobs/dev-advocate
- Engineering Manager: https://www.osohq.com/jobs/eng-mgr
But truth be told, if you reach out to us via Slack/email/whatever we will do our best to help you regardless. Every eng on the team takes part in our community support rotation. We typically respond to a new Slack message in <5 min during business hours, and we watch it closely and respond as quickly as possible outside of that. We are eager to help our users.
The commercial support options are for customers that require specific contractual SLAs, etc.
We’ll have a commercial product geared towards ops and security teams. We’re not yet ready to take the wraps off anything yet, but among the things we’re working on or planning: an oso mgt, service, auditing, policy governance, etc. See also: https://news.ycombinator.com/item?id=25443747
Would even be great to move beyond terms like attributed-based access control (ABAC), which many devs aren't familiar with even if they've actually built those features (e.g., a user can read her own data). ABAC is technically so broad, when in reality it's the underlying patterns that matter, e.g., hierarchies, sharing, multi-tenancy...many more.
oso (backed by Sequoia) puts security in the hands of the makers. We're doing this by delivering security as code, or as Charity Majors (cofounder & CTO of Honeycomb) put it, "Consumer-quality developer tools" for security (https://twitter.com/mipsytipsy/status/1288326027001782273) – beginning with an open source policy engine for authorization.
We open sourced oso this past summer, and the feedback has been amazing. We are hiring folks who want shave down the time developers have to spend thinking about things like roles and route authorization. We spend the bulk of our time building the oso policy language, Polar, and libraries on top of it. We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. The team members who join now will not only have a disproportionately large impact on the product and the community, but also on the culture and future of the company.
We are based in NYC and hiring folks remote or onsite.
To apply, please visit:
- Software Engineer: https://www.osohq.com/jobs/eng
- Developer Advocate: https://www.osohq.com/jobs/dev-advocate
oso (backed by Sequoia) puts security in the hands of the makers. We're doing this by delivering security as code, or as Charity Majors (cofounder & CTO of Honeycomb) put it, "Consumer-quality developer tools" for security (https://twitter.com/mipsytipsy/status/1288326027001782273) – beginning with an open source policy engine for authorization.
We open sourced oso this past summer, and the feedback has been amazing. We are out to build a big, vibrant community of open source users, and we need to be proactive to achieve that goal. To that end, we are hiring our first Developer Advocate. This person will report to the cofounder/CTO and work closely with him, the cofounder/CEO, and the rest of the engineering team.
We are hiring folks who want to put security in the hands of fellow makers. We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. The team members who join now will not only have a disproportionately large impact on the product and the community, but also on the culture and future of the company.
We are based in NYC and hiring folks remote or onsite.
To apply, please visit https://www.osohq.com/company/jobs or email jobs [at] osohq [dot] com.
oso (backed by Sequoia) puts security in the hands of the makers. We're doing this by delivering security as code, or as Charity Majors (cofounder & CTO of Honeycomb) put it, "Consumer-quality developer tools" for security (https://twitter.com/mipsytipsy/status/1288326027001782273) – beginning with an open source policy engine for authorization.
We recently released oso into Developer Preview, and the feedback has been amazing. We are out to build a big, vibrant community of open source users, and we need to be proactive to achieve that goal. To that end, we are hiring our first Developer Advocate. This person will report to the cofounder/CTO and work closely with him, the cofounder/CEO, and the rest of the engineering team.
We are hiring folks who want to put security in the hands of fellow makers. We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. The team members who join now will not only have a disproportionately large impact on the product and the community, but also on the culture and future of the company.
We are based in NYC and hiring folks remote or onsite.
To apply, please visit https://www.osohq.com/jobs/dev-advocate or email jobs [at] osohq [dot] com.
oso (backed by Sequoia) puts security in the hands of the makers. We're doing this by delivering security as code, or as Charity Majors (cofounder & CTO of Honeycomb) put it, "Consumer-quality developer tools" for security (https://twitter.com/mipsytipsy/status/1288326027001782273) – beginning with an open source policy engine for authorization.
We recently released oso into Developer Preview, and the feedback has been amazing. We are out to build a big, vibrant community of open source users, and we need to be proactive to achieve that goal. To that end, we are hiring our first Developer Advocate. This person will report to the cofounder/CTO and work closely with him, the cofounder/CEO, and the rest of the engineering team.
We are hiring folks who want to put security in the hands of fellow makers. We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. The team members who join now will not only have a disproportionately large impact on the product and the community, but also on the culture and future of the company.
We are based in NYC and hiring folks remote or onsite.
To apply, please visit https://www.osohq.com/company/jobs or email graham [at] osohq [dot] com.
oso (backed by Sequoia) makes backend infrastructure security not terrible for developers and ops. We provide a normalized and consistent interface to core security controls, like who can access what, and we do so in a way that’s invisible to developers and simple for ops. We are hiring small number of sharp engineers who want to get involved on the ground floor and who have some combination of experience in and appetite for taking on these kinds of problems:
1. Building an elegant experience for a highly technical end-user, e.g., making it easy and intuitive for an ops engineer to get up and running in <5 mins
2. Low-level distributed systems, e.g., building lightweight proxies that manage requests asynchronously and deal with things like caching and network failures
3.Running an on-path production service, e.g., building a scalable and resilient service layer across multiple regions and cloud providers
We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. By virtue of our stage, the engineers who join now will not only have a disproportionately large impact on the product, but also on the culture and future of the company. Given the importance of these team members and magnitude of their contribution, they will get a meaningful equity position.
To apply, please email graham [at] osohq [dot] com
oso (backed by Sequoia) makes backend infrastructure security not terrible for developers and ops. We provide a normalized and consistent interface to core security controls, like authentication and encryption, and we do so in a way that’s invisible to developers and simple for ops. We are hiring small number of sharp engineers who want to get involved on the ground floor and who have some combination of experience in and appetite for taking on these kinds of problems:
1. Building an elegant experience for a highly technical end-user, e.g., making it easy and intuitive for an ops engineer to get up and running in <5 mins
2. Low-level distributed systems, e.g., building lightweight proxies that manage requests asynchronously and deal with things like caching and network failures
3. Running an on-path production service, e.g., building a scalable and resilient service layer across multiple regions and cloud providers
We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. By virtue of our stage, the engineers who join now will not only have a disproportionately large impact on the product, but also on the culture and future of the company. Given the importance of these team members and magnitude of their contribution, they will get a meaningful equity position.
Founding team: Graham Neray (early employee and Chief of Staff at MongoDB) and Sam Scott (PhD in Cryptography).
To apply, please email graham [at] osohq [dot] com
oso (backed by Sequoia) makes backend infrastructure security not terrible for developers and ops. We provide a normalized and consistent interface to core security controls, like authentication and encryption, and we do so in a way that’s invisible to developers and simple for ops. We are hiring small number of sharp engineers who want to get involved on the ground floor and who have some combination of experience in and appetite for taking on these kinds of problems:
1. Building an elegant experience for a highly technical end-user, e.g., making it easy and intuitive for an ops engineer to get up and running in <5 mins 2. Low-level distributed systems, e.g., building lightweight proxies that manage requests asynchronously and deal with things like caching and network failures 3. Running an on-path production service, e.g., building a scalable and resilient service layer across multiple regions and cloud providers
We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. By virtue of our stage, the engineers who join now will not only have a disproportionately large impact on the product, but also on the culture and future of the company. Given the importance of these team members and magnitude of their contribution, they will get a meaningful equity position.
Founding team: Graham Neray (early employee and Chief of Staff at MongoDB) and Sam Scott (PhD in Cryptography).
To apply, please email graham [at] osohq [dot] com