pquerna
Joined 17 years ago
Karma
2,885
Submissions
410
Member since
Aug 28
Recent submissions
Comment · 13 days ago
Timestral is not free - it has a "Modified" MIT, which requires you to buy from Mistral if your global business makes more than $20m a month.
Calling it "Modified" MIT is just misleading.
Comment · 1 month ago
When we started C1.ai - 2020 - as someone who worked previously at Okta - I made a decision to only implement OIDC. (see article for all of the reasons). We were worried in the first 2 years, that some big enterprise would force us to implement SAML.
But it turns out, all the major IDPs support OIDC now. It's a non-issue.
Comment · 1 year ago
it's happening?
"Ex-Intel executives raise $21.5 million for RISC-V chip startup":
https://www.aheadcomputing.com/
I believe the founding team is all in Oregon - and mostly all ex-Intel.
Comment · 1 year ago
okta is not "active-active" in a multi-region sense, they run in a single active AWS single Region per-tenant. You can pay extra to have a faster failover in a region level failure scenario:
https://support.okta.com/help/s/article/overview-of-enhanced...
Comment · 2 years ago
per <https://trust.okta.com/security-advisories/okta-ad-ldap-dele...>
2024-07-23 - Vulnerability introduced as part of a standard Okta release
This issue is not an "okta is old" issue. this was new code written in 2024 that used a password hashing function from 1999 as a cache key.
Comment · 2 years ago
Our app <https://www.okta.com/integrations/conductorone/> is in the Okta OIN ("marketplace") using OIDC? So not sure what you mean by that?
Comment · 2 years ago
This is an Eclipse foundation project, not an Apache Software Foundation (ASF) project?
it's all volunteers/open source, but this isn't an ASF project.
Comment · 2 years ago
What about "access controls" for the AuthZ side, instead of Permissions?
Wondering HNs collective wisdom on this-- at work we've been using Access Controls on our homepage for awhile- https://www.conductorone.com/ - to the people outside the IAM-geek space does this make more sense?
Comment · 2 years ago
For this general pattern implemented in Golang, check out redis_rate:
https://github.com/ductone/redis_rate
This fork also implements Redis Client Pipelining to check multiple limits at the same time, and Concurrency Limits.
Comment · 2 years ago
The API for Let's Encrypt to do this requires possession of the private key, which pwned keys doesn't always have. Sometimes they just have an "attestation" of compromise:
https://pwnedkeys.com/submit.html
Which if you had an standardized representation of that attestation, maybe CAs could consume that instead.
But, the author of pwnedkeys thought of that, and started an RFC for exactly that:
https://github.com/pwnedkeys/key-compromise-attestation-rfc/...
But it seems dead right now.
Comment · 3 years ago
You can also just, Log the spans as they are being created to stderr/stdout -- I've done this on a previous project with this approach of "spans first".
It made it debuggable via output if needed, but the primary consumption became span oriented.
Comment · 3 years ago
Yeah, but... shouldn't Github of rotated their keys over the last decade?
I mean it seems like its clearly a key that wasn't in an HSM.. and over the lifetime, hundreds? Thousands of Github employees could of accessed it?
Comment · 3 years ago
Would it of been possible for Github to use Host-key rotation instead of hard breaking it?
https://lwn.net/Articles/637156/
I'm honestly not familiar with anyone actually using host-key rotation?
formerly: ScaleFT CTO (acquired by Okta), cloudkick dude, rackspace racker. (yc w09, acquired dec 2010 by rackspace)
apache httpd hacker.
blog thing: https://paul.querna.org/