orweis
Joined 14 years ago
Karma
64
Submissions
92
Member since
Sep 15
A man of action and passion; always aspiring to the top. Strong on the tech, and soft on the heart.
View on Hacker NewsRecent submissions
Comment · 2 years ago
Nice! Thanks for the share - I'm Or one of the founders or Permit.io.
Happy to answer any questions.
Comment · 2 years ago
Thanks a ton for the mention, and hope you like it.
If you haven't also check out our video: https://youtu.be/JMzr21rnBes
Fine-grained authorization is becoming a staple, we hope to make not just building but also using it a breeze.
Comment · 2 years ago
Or Weis, CEO at Permit.io here.
For the last three years, we have all seen a huge spike in developers implementing fine-grained authorization. Whether they choose the Google Zanzibar implementation or the OPA/Cedar policy approach, it has become a fundamental security and product requirement.
While trying to provide the best developer experience of implementing FGA with Permit.io, we saw developers use our APIs to build the experiences for request access and approval flows over and over again. Hence, we decided to take it a step further and launch a new product on top of the Permit.io platform - Permit Share-If.
"Permit Share-if" is a suite of prebuilt, embeddable UI components. They provide fully functional access control and allow developers to create and embed custom interfaces such as user management, audit logs, access requests, operation approval flows, and more.
You've probably seen access-sharing components (E.g., Requesting to edit a document, viewing a widget in a dashboard, or submitting a wire transfer for approval) a million times before. Now, you can implement them with just a few lines of code, providing the best FGA experience for your users.
Give them a try! Would love to hear your thoughts on this new release!
Comment · 3 years ago
Hi!
Fair point. We got two articles coming this month: RBAC vs ReBAC, and RBAC vs ReBAC vs ABAC - we'll post those here / in the article itself when ready.
For now, in short: RBAC (Role based) is a simple identity to role to permission mapping. ABAC (Attribute based) maps conditions on attributes to to permissions (technically can implement anything - mostly used for things like time based, quotas, location, etc.) ReBAC (relationship based) maps relations between identities and resources to permissions (e.g. if a user is related as an owner to a folder, and the folder contains a file, the user is the owner of the file) - commonly used for resource and organization hierarchies
Comment · 3 years ago
Agree 100%. <3
And as I told Joey many times - I'd love to collaborate more with you as well.
Comment · 3 years ago
Re: "Graphical" - I can see how that would have that effect :)
To be fair it doesn't really say that, it reads:"Graph-based authorization systems utilize a graphical representation to illustrate relationships between users and resources"
Still, I think Daniel (post author) could have picked better phrasing - I'll ask him to change it.
> "while claiming that Zanzibar-type systems aren't deployable at the edge" For most companies it's extremely impractical; and for a developer (Audience of this article) that simply wants to add performant permissions to their without embarking on a whole devops adventure it's as good as so.
Comment · 3 years ago
Jimmy I truly think you're awesome (And so is SpiceDB), but the irony here stands out:
"it presents opinion without any evidence or examples to justify the claim and concludes it as fact"
You mean stuff like: 1) "SpiceDB, the most mature open source project inspired by Zanzibar" (though I'd vouch for that one) 2) " it is necessary beyond a particular scale which is well beyond the point at which policy engines typically fall over." 3) "Zanzibar is novel because it is fundamentally designed to be ran at the edge" 4) "we recently managed to scale SpiceDB to >1M requests per second with 100B relationships while maintaining a 5ms p95 measured at the client application" - you should bundle that statement with you need to set it up within your own VPC for it to be fair. 5) "The claim that you absolutely need a service to run a Zanzibar system is a provably false claim based on the number of clusters in the wild running SpiceDB or Ory's Keto project" - how many clusters? :)
Re: "This article conveniently leaves out how other systems get data to the edge while still keeping it consistent for their authorization logic" The article actually does mention OPAL [0]
Comment · 3 years ago
In Zanziabr - The article refers to OSS implementations like SpiceDB or Ory.
It's a follow-up to a more in depth article (1), trying to be a lighter read starting point.
Comment · 3 years ago
Founder of Permit.io here- cool that this article grabbed some love.
For those of you not sure which is the best from the article- Permit combines all 3 together.
- OPA/REGO or Cedar at the edge, for quick efficient and zero latency policies - And Zanzibar at the cloud control plane to manage the overall picture and relationships