Readit Newsash commented on Tailscale is pretty useful blog.6nok.org/tailscale-i... · Posted by u/thm
Is there an alternative to Tailscale with a lower memory footprint? I wanted to run Tailscale on a small router, but it failed due to out-of-memory (OOM) issues.
Have you tried "Smaller binaries" instruction? https://tailscale.com/kb/1207/small-tailscale
ash commented on OpenAUTH: Universal, standards-based auth provider openauth.js.org/... · Posted by u/jacobrussell
> Even redirects aren't necessary if OAuth is implemented in a browser-less or embedded browser fashion, e.g. SFAuthenticationSession
Can you please expand on that or give me some hints what to look at? I have never heard of this before and I work with Oauth2 a lot.
When I look for SFAuthenticationSession it seems to be specific to Safari and also deprecated.
I always share this article because people overimplement OAuth2 for everything, it’s not a hammer: https://www.ory.sh/oauth2-openid-connect-do-you-need-use-cas...
The article by Ory's Aeneas Rekkas perfectly describes OAuth / OIDC problems. The only thing it misses is the suggestion for the alternative protocol for first-party auth. It does suggest that it's preferable to use simpler systems like Ory Kratos. But OAuth / OIDC is a set of protocols, not an implementation. Is there an a effort to specify simple auth protocol, when third-party auth is not needed?
ash commented on OpenAUTH: Universal, standards-based auth provider openauth.js.org/... · Posted by u/jacobrussell
ash commented on OpenAUTH: Universal, standards-based auth provider openauth.js.org/... · Posted by u/jacobrussell
Cool project!
OAuth-based auth providers are nice, but they can have a weakness. When you have just one app, OAuth can be overkill: protocol is complex, and users suffer jarring redirects¹.
This is not surprising, because OAuth / OIDC is fundamentally designed for (at least) three parties that don't fully trust each other: user, account provider and an app². But in a single app there are only two parties: user and app itself. Auth and app can fully trust each other, protocol can be simpler, and redirects can be avoided.
I'm curious what OpenAUTH authors think about it.
¹ Except for Resource Owner Password Credentials (ROPC) grant type, but it's no longer recommended: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur...
² In addition, OAuth is mostly designed for and by account providers, and follows their interests more than interests of app developers.
Related & referenced String theory is not dead (11 points, 22 days ago, 5 comments) https://news.ycombinator.com/item?id=42223650
Thank you! The video is a criticism of that article.