jcmartinezdev

This is really old. JWTs are very safe.

What's the next stop? it's gotta be auth0

Even though those pop ups and paywalls are annoying, you shouldn’t be injecting custom CSS and JS like that. It’s just wrong.

And the location… well, if one day they need you, they’ll sure be glad they know your each steps and current location .

It’s not a bug, it’s a feature.

Rule 6: Never disagree with AI slop

Mistral is doing some really great stuff lately. Sure, it's hard to compete with OpenAI and Anthropic and their models, but they are taking up some interesting takes and designing their product in unique ways.

I like a lot what they are doing and I'll be watching them a lot more closely. I'd love to work for them btw!

We are all on the same boat now, whatever it takes us!

And that’s the thing… it’s good at writing down my ideas in way that I can’t as a non native English speaker.

But it needed the judgement, the experienced and suffered input to know what to help me write

When that happens, we'll having nothing else to do.

That's true! that make me feel better lol. The internet is so sensitive to AI slop, it's hard to know what's the right balanced of usage when writing.

yeah, I wrote it myself, but since I'm not a native English speaker, I do use AI to "fix" and "polish". I think AI made me a worst writer in a way lol.

it's my bad, I should have been more careful at keeping the content how I wrote it, without much of the fine tuning GPT did.

I worry about that too, but I'm not sure we are close to that yet. Maybe we'll end up working on legacy systems where AI would break more than it would fix, or maybe we would become prompters. Idk!

Auth0 is constantly releasing new features, including a new major offering now for AI agents. Plus is still very active in the development community, with open source like OpenFGA, frameworks, contributions to standards and so much more.

Not sure where the maintenance mode is coming from...

I've seen solutions implementing authorization in multiple ways, some still rely on the underlying services that map to the tools, guaranteeing the AT sent to those services is acting on behalf of the user.

Other's do checks at the tool level, systems like openfga can help make that easier by centralizing the authorization policies.

There are multiple ways, you can use known authorization methods like RBAC, or if you want something more fancy ReBac (tools like openfga, https://openfga.dev).

But there's only so much that you can do with that, if you need to call third party APIs on the user's behalf I'd recommend going with a solution revolving around custom token exchange (https://datatracker.ietf.org/doc/html/rfc8693).

You can check something like Auth0 offers: https://auth0.com/ai

Which would cover things like token exchange for third party APIs, human in the loop, and also authorization methods.

This is a really solid primer. I appreciate that the author didn't just jump straight to the most complex solution (CDC/Event Sourcing) but actually laid out the progression of strategies.

While "Sequential Dual-Write" is technically flawed, I think it's fair to admit that it's where 90% of projects start (and stay) until the pain becomes real.

That said, the section on the Transactional Outbox is the highlight here. It really is the most pragmatic middle ground for most engineering teams.It's as good as it gets without kafka.

Great read!

For what it looks, this is something where DCR (https://openid.net/specs/openid-connect-registration-1_0.htm...) could be helpful.

Some auth providers like Auth0 have support for it: https://auth0.com/docs/get-started/applications/dynamic-clie....

There are some caveats and security concerns when using DCR, so you should research more into that. Another option may be CIMD (https://www.ietf.org/archive/id/draft-parecki-oauth-client-i...) though I'm not totally familiar with it.

What you also mentioned, like using proxys, or wildcards, is also widely used, at least for what I've seen.

I'm hiring for a senior developer content advocate, and Okta/Auth0 has more open positions.

Here's my currently open position: https://www.okta.com/company/careers/marketing/senior-develo...

In Germany you also have the UG which is like a small GmbH, with 1 eur minimum capital requirement, that is if you like like the 1k (and up to 2k) it cost to set up.

Some tax consultants are very shady, and some are really arrogant. I'm currently looking for one as we had some disagreements on pricing with my previous one, and many won't even take me due to my volume, or maybe because I ask to speak English, idk...

But sometimes I feel they are doing me a favor by taking my company, rather than me feeling like I'm hiring them as a service.

Can you recommend a tax consultant that charges 200 EUR/month including preparing the yearly statements?

I’m nearly at 3.5k/year and I have barely 10 invoices a month that I need to process between incoming and outgoing lol

Maybe I should have taken another road considering the size of my operations, unfortunately I was wrongly advised when starting up, I spent 1k with a Steuerberatung for advice on what was the proper structure for me, and still… I think they just adviced me the option that was gonna cost me the most to operate.

Lesson learned I guess!

But that’s the thing, even though it took weeks I spent a non insignificant amount of euros to set it up, I think it was nearly 2k at the end; and to make it quick would probably be another K or so?

It’s crazy expensive, because of all the bureaucracy. The UG is supposed to be quick and easy to set up, requiring minimum capital… but the process proves expensive.

gmbh or UG, takes about that time to set up, you can start billing before, but still... this is a lot of time of manual paperwork.

I had my experience with bootstrapping a self founded UG (Unternehmergesellschaft), and the process was long (about 8 weeks), involving me getting support from a company (firma.de) to help me prepare all the documentation which involved a lot of physical paperwork, then there's the visit to the notary which is required. After you do that, you need to register with the Finanzamt, and then you start finding out about all this other registries you need to pay and register to, or that you're automatically registered, but you receive separate invoices.

Any changes you need to make, adding more capital, change address, requires again, paperwork, tons of hours and again the notary.

Taxes are also quite difficult to figure out, I'm not German born, and my German is good for conversation, but to read and understand the tax has been a problem and I had to rely on very expensive tax consultants. (I know, this is my problem, not a german problem)

It's not that is hard, it's very time consuming, manual, and involves a lot of paperwork. Other countries do this much easier. Also, shutting down a company... I'm still trying to figure that out :(

Never underestimate the power of german bureaucracy lol

That's great to know! In Germany it involves a lot of physical paperwork, going to a notary to certify the creation, taxes are a nightmare, every change you need to make again you need a notary. It's so frustrating!

I really looking forward to this! I love being in the EU and I really like living in Germany. But creating and operating a small company in Germany is a nightmare, I hope this can give smaller EU companies agility and frictionless setup and operation so they can focus on building products and providing services to their customers.

It's a volume problem, almost feels like people is spamming HN for quick results. I do appreciate some of the projects and conversations that happened from some of those threads, but a lot of it, it's just feels spam.

It backfired badly, and now it was a mistake... Seems like posting it helped giving it some sort of resolution