mooreds

What does KLTO mean?

I work for a Cognito competitor, but I am glad to see them investing in improving the lives of folks using this native AWS service.

It felt like Cognito was abandoned for a while.

That's fair. The companies do care about building a sustainable business. But so do the companies that sell lawnmowers.

I'm not sure that make either thing being sold (LLMs or machines to cut grass) able to care.

I have seen the same thing in a local slack I frequent. Not weekly, but once a month or so.

It doesn't last long, but it sure is annoying. Sometimes they even join and then spam DM rather than post in a public channel.

It must pay off often enough to make it it worth it, but I can't imagine hiring someone I found through a spam message.

I mean, the device code grant was codified by the IETF in 2019[0]. That is no guarantee that it is 100% secure, but folks have spent time working to make it as safe as possible. There's also a Best Current Practice (BCP) doc[1] and if you have suggestions to improve the flow, they'd be welcomed.

0: https://datatracker.ietf.org/doc/html/rfc8628

1: https://datatracker.ietf.org/doc/draft-ietf-oauth-cross-devi...

FYI, all the roles listed show SF as the location (London isn't mentioned).

FusionAuth | Principal Software Engineer, Senior Java Engineer - Cloud, Account Executive, Solutions Engineer | Varies between REMOTE (in USA, also in Europe but only for the account exec/solutions engineer positions) and ONSITE in Denver, CO, USA, details in each job desc | Salary ranges for the Principal Software Engineer it is 225k-270k, but the Euro positions don't have them :(

At FusionAuth, our mission is to make authentication and authorization simple and secure for every developer building web and mobile applications. We want devs to stop worrying about auth and focus on building something awesome.

There are a lot of companies in the auth space, but we feel like we have something special:

* a relatively unique deployment model (self-host on-prem, run in your cloud or let us operate it for you in ours)

* A well designed API first approach; one customer compared our APIs to petrichor

* a mature product (the code base is nine+ years old and we've found and fixed a lot of the sharp edges around core login use cases; but don't worry, there are plenty more features to add)

* a full featured free-as-in-beer version which makes the sales cycle easier; prospects often come in having prototyped an integration

Our core software is commercial. We open source much of our supporting infrastructure. Technologies and standards that you will work with: modern Java, PostgreSQL, Docker, Kubernetes, MySQL, OAuth, SAML, OIDC.

Learn more, including benefits and salaries, and apply here: https://fusionauth.io/careers/ ( Click/tap the 'View open positions' orange button. )

> Agents are really nice to quickly craft utilities to speed up planning.

Reminds me of a conversation I had with Kelsey Hightower where he suggested that using agents to build utilities and software was a smarter way to proceed than using agents to do the work. It is almost like the software artifacts are a cached version of your understanding of the problem and can be used over and over again until the problem (or your understanding of it) changes.

> If the developer wants to move the project beyond that, it requires domain knowledge and a lot of hacking.

Reminds me a bit of this blog post[0].

I remember doing a Drupal project around that time and being astonished at how powerful it was.

I also remember feeling more like a technician connecting various components than like a software engineer, writing code.

I totally saw the value for the client but I really disliked my experience, so I avoided it afterwards.

0: https://www.rickmanelius.com/p/the-website-rfp-and-the-impos...

Not sarcasm. I guess I've just had different experiences than you.

The larger point of the effort involved before the employees' last day still stands. But that's a hard one to speak to generally, since most folks in layoffs or firings don't talk about the process used to arrive at the decisions.

Have you known folks at those jobs to be notified of being let go and sent home on the same day?

Have you been involved with letting people go and seen it happen as quickly as the above legal disclaimer implies?

I agree that the legal justification is 100% there, but in my experience it is often buffered and takes more time.

Yeah.

https://www.youtube.com/watch?v=ahlH32Lprto is a video from Peter Zeihan covering that exact topic.

Man, the older I get, the more I think that second and third and fourth order effects are way more important than first order effects.

> Who is investing in that?

Big companies that see the opportunity to be "Not AWS"?

A VPS provider who wants to grow their marketshare?

Nation states?

Not saying it'll be a small effort, but if the US continues to wield national laws to coerce American companies to negatively affect European citizens, it's possible.

There's the legal world and then there's the world of custom and ethics. They don't always diverge, but in my experience they do.

At least over the last 25 years in the tech spaces I've been part of, I rarely hear of people being dismissed/let go quickly. #anecdata

From the article:

> In the U.S. you generally can’t just up and fire someone, even if they are underperforming, even if it’s at-will employment, without risking a lawsuit and some sort of cash outlay. This is what makes hiring decisions so high-stakes.

I've been part of a few situations where someone had to be let go in the USA, and I can tell you it wasn't a trivial decision. There were legal aspects, sure, but there was also a personal aspect. As a boss said once "this is someone's life we're talking about here".

> We can have actual conversations with our computers,

Not just computers, but documents! It's amazing to be able to paste in a few RFCs and then interrogate the documents to get a better understanding of them.

It is truly an amazing time we live in. I get the worries and fear too, but it is still amazing.

I co-founded a startup. Trite, I know, but the skills I learnt going from zero to one, talking to customers, relying on no-one else and owning all the tech decisions (I had a non-technical co-founder), and the community it forced me to build--those were all priceless.

Oops, sorry: https://theconsensus.dev/p/2026/05/20/yeunjoo-choi-from-igal...

I get that the writing was a bit over the top.

But the story, my goodness. Giving a damn is such a rare commodity. It makes me sad when companies throw away people with that quality.

I hope that Tarus Balog finds a good spot to land. Here's his LI: https://www.linkedin.com/in/tarusbalog/ if you're in the market for an "Open source wonk. Catalyst. Storyteller. Collector of Memories"

Here's the full proposed rule: https://www.federalregister.gov/documents/2025/01/06/2024-30...

Haha, tells you something about the NPM ecosystem that rather than sharing the year something was published (typical for HN) I should reference the exact date.

Just want to say we've been happy customers of nodebb for years. They host our forum[0] and we've been thrilled with the uptime and service.

I wrote before about how important forums are for discovery and self-service[1] and I think that is even more true with LLMs.

ChatGPT can't search in your slack or discord to surface answers without special help, whereas if you put the info out on a forum, it surfaces naturally.

0: https://fusionauth.io/community/forum/

1: https://news.ycombinator.com/item?id=29154216

Stephen Colbert hosted a public access show the day after his Late Show run ended.

I thought the same darn thing. Too bad there's not a ex-Space-X index fund.

I wrote a post[0] a few years ago about how you basically get OAuth when you start layering security principles (rotation, time limits, central verification) onto API keys.

Turns out those standards writers knew something!

0: https://fusionauth.io/blog/securing-your-api

This is the thing that gets me about all the AI security pieces I read. Yes, AI can enable new attack vectors (prompt injection can be repeated N times when a human subject to the same messaging would bail).

But what AI really does is shine a spotlight on all the flaws folks like OWASP have been talking about for decades.

Secret rotation and short lived credentials don't require AI to implement, nor does their lack require AI to exploit.