vinckr

I'm getting blocked or rather served nonsense because the site thinks I'm an AI scraper :/

I guess this is normal now

That is fair yea. I reckon that's why many parks put up signs to not feed the birds.

I guess if you are serious about it you can spread it out and drop your peas in different areas and/or don't drop a huge amount at once.

I just thought the same thing. Most of them cost double what my refurbished iPhone cost. To be fair there is a category for fairly cheap ones too: https://slowerliving.club/phones/?category=Cheap+entry+point...

But why would someone pay $675 to $1,235 plus $18/mo membership for a locked down iPhone without browser and apps - surely there is a way to lock them down yourself if you really want to.

edit: reading a bit further I find the LLM-prose on the website really jarring. Maybe I'm unfair here but it just reads like written by a machine.

several reasons why its bad.

- Bread doesn't have much nutritional value (especially the kind of white "bread" that is common in the US for example)

- It fills up their stomach fast so they don't forage for foods they would naturally eat

- Throwing bread at one place can lead to overcrowding (which is what happened in your great fishing spot) which stresses the animals

- They also shit a lot in one place, which leads to a bunch of problems

- Uneaten bread causes algae growth which leads to diseases and pests

best to feed them peas like in this neat app or I also heard that cut up frozen grapes are a good choice.

Just out of interest, what makes you choose Ory over Keycloak/WorkOs?

Ory Kratos has a password migration hook that lets you migrate password credentials out of anything (including Cognito) without password resets. I believe most other (modern) auth vendors have an equivalent.

I really don't see any reason to be using Cognito in $currentyear.

Disclosure: working for Ory.

Yup for the Ory managed service (Ory Network) you can export all data through the admin API including hashed passwords. Of course when self-hosting Ory you have full control over the database as well.

Disclosure: working for Ory.

Has that law ever been enforced ? (e.g. taking away a FOSS or other project that someone wrote in their own time)

in most cases you dont need explicit permission but you need to sign a CLA (Individual Contributor License Agreement) - which kind of includes permission

Coming from Germany I found it funny how tiny the subway lines are in major cities in the US compared to medium-sized cities here.

I always thought Germany was a country centered a lot around cars but it was so much more extreme in the states; seemed not possible to live in a city(!) without a car.

Personally I hate magic links via email with a passion and will actively avoid products that have this as the only authentication method

I don't think we can let that one go so easily, since they might not be scanning for ad targeting (pinky promise?) - but they most certainly will slurp everything up for their AI stuff: https://blog.google/products-and-platforms/products/gmail/gm...

How is it obvious that this project bought starts on GitHub?

Very cool, thanks for sharing. Feel free to add it to https://github.com/ory/awesome-ory !

> Tickets cannot be moved between trackers

You can convert an issue to a discussion and vice versa, so no duplication is needed and your notification should be preserved.

Or do you mean something else?

after clicking on your link I browsed twitter for a minute and damn that place has become weird (or maybe it always was?)

I think most commit messages use conventional commits (https://www.conventionalcommits.org/en/v1.0.0/) - I found them to be quite useful for creating structures commit messages.

I think gitmore could be improved if it used the conventional commits specification, there is a reason almost everyone uses them.

These are fair concerns, and I want to clarify what's included versus what's paid.

The confusion here is about two different types of SSO:

_Admin SSO (for managing Ory itself)_ - Ory is fundamentally an API. For self-hosted deployments, you control access however you want - through your infrastructure, reverse proxy, or using Ory Polis. This is not gated.

_Organizations SSO (for your end users)_ - This is the paid feature. It allows your B2B customers to bring their own identity provider. If you're building a SaaS product and BigCorp wants their employees to authenticate using Okta or Azure AD, Organizations handles that federation.

The distinction matters because maintaining integrations with enterprise IDPs is continuous work. For example Google randomly changes their OIDC implementation on a Saturday evening. Someone needs to wake up and fix that. For products serving other businesses at scale, that operational burden is real.

Organizations is one of the few areas where we charge, specifically targeting the B2B SaaS use case. If you're self-hosting for internal use or building a consumer product, you don't need Organizations. If you're selling to enterprises that require SSO, you're generating revenue to support the cost.

if you leave the admin APIs unsecured in production it is an attack vector, not sure what you would prefer being told here?

It says "When deploying Ory open-source Servers, protect access to their APIs using Ory Oathkeeper or a comparable API Gateway."

sorry to hear that, hope you have a better experience going forward. if you feel like it send me some details on what was most painful and we'll fix it.

Another problem is also that "standards" like OAuth2/OIDC are used for a thousand use cases that weren't intended by the authors, so people get really creative with them. Plus the spec itself is vague on many essential things, for example how logout should work. Thankfully I never had to implement SAML but I would guess it's even worse there...

if you are a masochist that is a great retirement project!

Check out Ory Polis if you want SAML/SCIM support: https://github.com/ory/polis

CAPTCHA is not in scope for Kratos, there are already great solutions out there that you can use

You can use other parts of the Ory ecosystem to add these features, such as Ory Polis for SAML/SCIM support: https://github.com/ory/polis

CAPTCHAs aren’t a big help anymore in my personal opinion, but you can easily integrate them on the frontend when using Kratos. The commercial offering just bundles all of this out of the box for you.

If Keycloak fits your needs well and you see no room for improvement, that’s perfectly fine; by all means use what works best for you.

you should check out Ory Polis if you are looking for SAML support in the OSS version: https://github.com/ory/polis

Ory Kratos itself doesn't support SAML that is correct.

However the newest addition to the Ory ecosystem, called Ory Polis (formerly known as BoxyHQ) does close that gap. It is also Apache2 licensed, do check it out here: https://github.com/ory/polis

i feel you; working with a heavily patched fork of anything can be rough check out the new version, i'm sure it has improved quite a bit since then. Of course simpler solutions than Ory Kratos exist, but they often come with other tradeoffs

sure, I would say its mostly correct. You can solve Permissions and API Gateway also differently - for example many use OAuth2 claims and scopes for permissions. I personally think that isn't good practice - like "first-party auth" I think its outside of the scope that OAuth2 was built for originally - but it works and many are used to building authz that way. You could also use the identity metadata on Kratos for permissions - this works well for simple RBAC usecases but if you want "large scale" and "finegrained" something like Ory Keto is probably the more reasonable choice.

Feel free to message me on the Ory Community Slack if you want to discuss further: https://slack.ory.com/

that's fair! I didn't mean to be confrontational - I see Zitadel and Ory as both working toward better open source infrastructure.

At Ory, features like high-availability setups, zero-downtime upgrades, large scale multi-tenancy, and formal SLAs are part of the commercial offering. In most cases, if you’re not operating Ory at large enterprise scale, you won’t need those.

It’s a reasonable tradeoff: the commercial offering covers the costs of maintaining those capabilities and helps fund continued open source development. Big organizations that rely on Ory in production should ideally help sustain the ecosystem they depend on.

Hey, if you want to share a bit more feedback would love to hear it! feel free to also message me directly if you don't want to share it here.

tbh i don't know too much about it other than that they moved away from the apache2 license recently

(disclaimer: I'm working for Ory)