can't believe I let myself write this code
December 22, 2024 at 7:12 PM
can't believe I let myself write this code
we need new words for authn and authz that don't have anything to do with each other
December 22, 2024 at 7:13 PM
we need new words for authn and authz that don't have anything to do with each other
Mas vc Prometheus que não ia subir recursos sem AuthN 😢 #bolhasec @carlosenog.dev
December 12, 2024 at 2:42 PM
Mas vc Prometheus que não ia subir recursos sem AuthN 😢 #bolhasec @carlosenog.dev
This bambu stuff is so dumb. Why on earth did they make a proprietary "network" "plugin" solely to obfuscate communication with their servers? Why not just... design a proper web API with proper authn and authz?
May 22, 2026 at 3:29 AM
This bambu stuff is so dumb. Why on earth did they make a proprietary "network" "plugin" solely to obfuscate communication with their servers? Why not just... design a proper web API with proper authn and authz?
I think you should be able to request just 'atproto' scope for just authn
November 16, 2025 at 12:59 AM
I think you should be able to request just 'atproto' scope for just authn
after wasting like three days trying to deal with inconsistent behavior in oidc/oauth2 implementations i have become a radical transparency advocate
fuck authn, fuck authz
fuck authn, fuck authz
May 15, 2024 at 4:28 PM
after wasting like three days trying to deal with inconsistent behavior in oidc/oauth2 implementations i have become a radical transparency advocate
fuck authn, fuck authz
fuck authn, fuck authz
authn is short for authentication, authz is short for authorization
December 22, 2024 at 7:32 PM
authn is short for authentication, authz is short for authorization
The AT protocol is full of cryptography goodies but when it comes to actually user-facing authn, they forgot passkeys exist in big $CURRENT_YEAR
July 5, 2026 at 9:26 PM
The AT protocol is full of cryptography goodies but when it comes to actually user-facing authn, they forgot passkeys exist in big $CURRENT_YEAR
lastly, client authentication is great and it helps in two ways. first, it secures the authn flow by allowing the auth server to confirm who it's handing creds. potentially more importantly, it also gives the client the ability to revoke credentials en masse...
June 13, 2025 at 4:15 AM
lastly, client authentication is great and it helps in two ways. first, it secures the authn flow by allowing the auth server to confirm who it's handing creds. potentially more importantly, it also gives the client the ability to revoke credentials en masse...
Trusted publishing is good, but it's still just an authn method and doesn't mean the package itself is safe to run.
Good breakdown by @yossarian.net about that
Good breakdown by @yossarian.net about that
August 4, 2026 at 4:40 PM
Trusted publishing is good, but it's still just an authn method and doesn't mean the package itself is safe to run.
Good breakdown by @yossarian.net about that
Good breakdown by @yossarian.net about that
this is my line: all agent work should be attributed to a human
it’s a simple rule that vastly simplifies just about any authz/authn conversation around agents
it also provides clear guidance for how an agent fits into an organization (socially speaking)
it’s a simple rule that vastly simplifies just about any authz/authn conversation around agents
it also provides clear guidance for how an agent fits into an organization (socially speaking)
I also DO like how an agent's "work" is now attributed to the dev kicking it off
As it should be!!
In the end, the dev still 100% responsible for shipping code. If they ship a regression: that was the DEV's decision. AI doesn't "decide" anything - it's a tool!
As it should be!!
In the end, the dev still 100% responsible for shipping code. If they ship a regression: that was the DEV's decision. AI doesn't "decide" anything - it's a tool!
May 24, 2025 at 7:04 PM
this is my line: all agent work should be attributed to a human
it’s a simple rule that vastly simplifies just about any authz/authn conversation around agents
it also provides clear guidance for how an agent fits into an organization (socially speaking)
it’s a simple rule that vastly simplifies just about any authz/authn conversation around agents
it also provides clear guidance for how an agent fits into an organization (socially speaking)
I use Zitadel for AuthN, and it supports machine to machine authentication for system stuff. It's really slick
November 25, 2024 at 2:30 PM
I use Zitadel for AuthN, and it supports machine to machine authentication for system stuff. It's really slick
Episode #17 is out.
Kyle Simpson on local-first identity, encryption, passkeys and authn.
www.localfirst.fm/17
Kyle Simpson on local-first identity, encryption, passkeys and authn.
www.localfirst.fm/17
#17 – Kyle Simpson: Local-first identity - localfirst.fm
A podcast about local-first software development.
www.localfirst.fm
November 12, 2024 at 1:14 PM
Episode #17 is out.
Kyle Simpson on local-first identity, encryption, passkeys and authn.
www.localfirst.fm/17
Kyle Simpson on local-first identity, encryption, passkeys and authn.
www.localfirst.fm/17
Everything from Maps to Drive to Translate ran APIs on that infrastructure, which handled all authn/authz, logging, API key and OAuth token infra, routing, protocol translation (JSON/REST to Stubby), etc. And we were pretty proud of what it could handle.
February 19, 2026 at 12:22 AM
Everything from Maps to Drive to Translate ran APIs on that infrastructure, which handled all authn/authz, logging, API key and OAuth token infra, routing, protocol translation (JSON/REST to Stubby), etc. And we were pretty proud of what it could handle.
With AI agents on the horizon, we'll need better authn/authz primitives to grant access to agents in a fine-granular way beyond just "Login with Google".
Who is doing interesting work in this regard?
Who is doing interesting work in this regard?
February 2, 2025 at 10:23 AM
With AI agents on the horizon, we'll need better authn/authz primitives to grant access to agents in a fine-granular way beyond just "Login with Google".
Who is doing interesting work in this regard?
Who is doing interesting work in this regard?
tl;dr:
- Race condition in system that updates DNS records for DynamoDB instances causes deletion of key records
- DynamoDB becomes unavailable
- Tons of services relying on DynamoDB start to also go down (EC2, network load balancing, Lambda, ECS, EKS, Fargate, Connect, STS, IAM authn)
- Race condition in system that updates DNS records for DynamoDB instances causes deletion of key records
- DynamoDB becomes unavailable
- Tons of services relying on DynamoDB start to also go down (EC2, network load balancing, Lambda, ECS, EKS, Fargate, Connect, STS, IAM authn)
EVERYBODY GO READ THE AWS INCIDENT WRITE-UP! aws.amazon.com/message/1019...
Summary of the Amazon DynamoDB Service Disruption in Northern Virginia (US-EAST-1) Region
aws.amazon.com
October 23, 2025 at 2:59 PM
tl;dr:
- Race condition in system that updates DNS records for DynamoDB instances causes deletion of key records
- DynamoDB becomes unavailable
- Tons of services relying on DynamoDB start to also go down (EC2, network load balancing, Lambda, ECS, EKS, Fargate, Connect, STS, IAM authn)
- Race condition in system that updates DNS records for DynamoDB instances causes deletion of key records
- DynamoDB becomes unavailable
- Tons of services relying on DynamoDB start to also go down (EC2, network load balancing, Lambda, ECS, EKS, Fargate, Connect, STS, IAM authn)
sometimes I build elaborate mental constructions in my mind of how a world could have all the digital stuff work completely free of any concept of authN and authZ even needing to be a thing and it ends up looking like big factory control substations and all I’ve done is recreated electromechanics
I continue to be so confused by people not liking passkeys.
I love the UX, such an improvement.
Do y'all have a magical password manager that works without 15 taps in mobile apps?
Or are you self-defeating by not using the built-in (Chrome or iCloud) authenticator? Is this a Linux desktop issue?
I love the UX, such an improvement.
Do y'all have a magical password manager that works without 15 taps in mobile apps?
Or are you self-defeating by not using the built-in (Chrome or iCloud) authenticator? Is this a Linux desktop issue?
May 2, 2026 at 9:12 PM
sometimes I build elaborate mental constructions in my mind of how a world could have all the digital stuff work completely free of any concept of authN and authZ even needing to be a thing and it ends up looking like big factory control substations and all I’ve done is recreated electromechanics
Authentication (authn) vs authorization (authz), yup. Lots of systems and protocols don't distinguish them though
August 21, 2024 at 2:55 AM
Authentication (authn) vs authorization (authz), yup. Lots of systems and protocols don't distinguish them though
I wrote a 2-3k article explaining why authz and authn are different things and I ended up saying because the people who run each of them care about slightly different things
August 23, 2025 at 1:55 AM
I wrote a 2-3k article explaining why authz and authn are different things and I ended up saying because the people who run each of them care about slightly different things
Keep authn and authz separate.
Dont Cross The Streams Egon GIF
Alt: A geeky looking man says “don’t cross the streams”
media.tenor.com
August 24, 2025 at 1:40 AM
Keep authn and authz separate.
Saturday friendly reminder 👀 AuthN is required to obtain AuthZ, but AuthN != AuthZ
November 16, 2024 at 2:01 PM
Saturday friendly reminder 👀 AuthN is required to obtain AuthZ, but AuthN != AuthZ
The layers are great!
- Firehose: full Merkle Search Tree updates, cryptographic guarantees, big/slow
- Jetstream: contents, no MST diffs, faster but no authn (trusts firehose to check authn)
- Turbostream: Jetstream, but "hydrated" by filling in refs to users/other records
#atproto
- Firehose: full Merkle Search Tree updates, cryptographic guarantees, big/slow
- Jetstream: contents, no MST diffs, faster but no authn (trusts firehose to check authn)
- Turbostream: Jetstream, but "hydrated" by filling in refs to users/other records
#atproto
psa: @graze.social's TurboStream is pretty cool
it's jetstream but a bunch of linked data is pre-hydrated, so you don't need to do a bunch of xrpc calls when processing events!
user profile info is attached, parent posts are included with replies, embedded records from quote posts...
it's jetstream but a bunch of linked data is pre-hydrated, so you don't need to do a bunch of xrpc calls when processing events!
user profile info is attached, parent posts are included with replies, embedded records from quote posts...
Docs | Graze Turbostream
Details about the turbostream, a hydrated-reference variation of the jetstream
www.graze.social
August 5, 2025 at 8:39 PM
The layers are great!
- Firehose: full Merkle Search Tree updates, cryptographic guarantees, big/slow
- Jetstream: contents, no MST diffs, faster but no authn (trusts firehose to check authn)
- Turbostream: Jetstream, but "hydrated" by filling in refs to users/other records
#atproto
- Firehose: full Merkle Search Tree updates, cryptographic guarantees, big/slow
- Jetstream: contents, no MST diffs, faster but no authn (trusts firehose to check authn)
- Turbostream: Jetstream, but "hydrated" by filling in refs to users/other records
#atproto
Just migrating the @rawkode.academy Zitadel (AuthN) from Fly.io to GKE.
Exposed by the @ngrok.com Kubernetes Operator.
Such a pleasant experience.
zitadel.rawkode.academy
Exposed by the @ngrok.com Kubernetes Operator.
Such a pleasant experience.
zitadel.rawkode.academy
ZITADEL Console
Console Management Platform for ZITADEL IAM
zitadel.rawkode.academy
November 22, 2024 at 11:38 PM
Just migrating the @rawkode.academy Zitadel (AuthN) from Fly.io to GKE.
Exposed by the @ngrok.com Kubernetes Operator.
Such a pleasant experience.
zitadel.rawkode.academy
Exposed by the @ngrok.com Kubernetes Operator.
Such a pleasant experience.
zitadel.rawkode.academy
“And make it authn/z related”
May 8, 2025 at 6:58 PM
“And make it authn/z related”