Hacker News Reader

Comment by kyrra | Hacker News Reader

This was talked about 2 years ago on here[0]. This service was also brought up in the discussion[1] of Ory Keto, as it's based on Zanzibar.

[0] https://news.ycombinator.com/item?id=20132520

[1] https://news.ycombinator.com/item?id=26738344

View on HN

Airbnb Himeji also:

https://medium.com/airbnb-engineering/himeji-a-scalable-cent...

Casbin is another that’s pretty interesting I’ve been evaluating alongside Ory’s

https://casbin.org/

Is it my impression or nowadays the emerging technology in this sense is OPA (Open Policy Agent)?

It looks like a flexible system to build cross-language and cross-framework authorization systems.

I use OPA with terraform and kubernetes, but I’m looking for something for application ACLs, where I as a resource owner can assign permissions to arbitrary subjects for a resource.

Does OPA support that? If so that would be very very cool.

I think Ory Keto would be a better choice because it's easier to manage individual resources on an ad-hoc basis.

Certainly! Application and microservice authorization is probably one of the more common use cases for OPA, and there's definitely benefits in having a unified policy engine in an organization or company.

I have only found RBAC and ABAC docs and tutorials for OPA, do you happen to know of a good source of docs for ACLs like, User A gives User B edit rights on Resource C?

Update: I swear I’ve looked through the docs 20 times and I’ve never seen this use case, but of course after writing this comment I go back and immediately find what may work :-)

https://www.openpolicyagent.org/docs/latest/comparison-to-ot...

I am continuing to be amazed at how much over engineering Airbnb does for ostensibly a cleaner couch surfing broker. Like they don't actually do much even for a travel site, they have so much investment and could have easily disrupted so many different travel related Fields instead they keep over engineering software. Not sure how to feel about it (since we do kinda benefit from their busywork)

They have similar incentives to Uber where their main goal is to get engineers to work for them by being interesting, and it doesn't actually have to be profitable. I think Uber also writes blog posts about architecture to trick competitors into thinking it can't be done by sharding each city into one box under someone's desk.

Reply on news.ycombinator.com