I couldn't disagree more strongly; you will screw this up if you roll your own. The only secure option is to push as much as possible outside of your infrastructure. The concerns that it won't be "auditable" or that you "give away the keys to your kingdom" are nonsense and implementation-specific. If it's important, then don't build your integration with those flaws. You will still have substantial control, so you can decide how "auditable" the auth actually is and what to do with users authed from one platform or another.
If you can avoid managing authn, you will be substantially better off. I don't think you can so easily do this for authz; however, it depends on what you're building.
> you will screw this up if you roll your own. The only secure option is to push as much as possible outside of your infrastructure.
In my experience the integration with outside infra (OAuth, OIDC etc.) carries significant complications in itself, and Im not convinced that you really gain that much in terms of reducing complexity or attack surface by using these technologies. See this article that was on the front page yesterday for an example of non-obvious things that can go wrong https://trufflesecurity.com/blog/google-oauth-is-broken-sort...
> Im not convinced you really gain that much in terms of reducing complexity or attack surface by using these technologies.
In the case you mention (which I posted), integration of some kind offers functionality that would be otherwise impossible to get--single sign-on which lowers friction of user acquisition. SAML is one alternative method, but from my experience it has some sharp edges too.
Of course, whenever you're integrating a third party solution, you need to do so carefully.
Another issue is the opposite situation, where the library reads from the object multiple times, expecting the value to be stable, but the caller might change the value in between, either from the properties using getters or from the library being async. The library has to make a full deep copy to ensure that it's completely stable regardless of the caller's actions. Just freezing the input object would be confusing to the caller and still vulnerable to property getters.
Sure! Use a library that deep-clones the object first, leaving the original parameter unchanged! And now it's slower than the original library you're criticising.
If you know what modifications you need to make (hopefully the library author does), you only need to clone the relevant parts of the object (e.g. with spreading). Deep cloning still isn't usually necessary unless you're doing wierd stuff.
…the whole thread you’re replying to is about it not actually being necessary. To participate in this conversation you either accept that premise or disagree with it, passing it as a given is not really an option for the argument.
I’m so far left wanting for an app that gives me a way to easily track and consume newly published work of a given topic. The existing apps are not great, and maybe this change will make it easier to provide better “reader” views, and possibly even tts (I like to listen+read).
I actually read a whole book on the weaponization of human rights, and how some groups portray their cause as “noble” to get around the sticky questions such as motive and self-benefit. I’m not saying this exactly that, but there’s a lot of, “we’re doing this for you!” speech here that’s a bit out of line with the stakes of the problem…
Apple is doing it for our security and save the environment. If Apple can do it, others should be able to do it too.
After all, the whole SV is trying to make the world a better place, make humans interplanetary species, protect freedom of speech, democratise stuff etc.
It'd make for a useful additional option, as long as the app doesn't know it's happening. There are already ways to spoof GPS location, as many pokemon go players know.
iOS already has an option to give a very loose fix to an app.
Not that I think I can trust the phone actually disabled the GPS, but there is no reason my movements need to be tracked and recorded in detail. Make them go through the effort and pull up all the cellphone towers I ping.
Day to day, there is a very good chance I am still in my home city as first configured.
That's your choice! But suggesting everyone operate on a substantially less convenient basis due to your specific desires for privacy seems... selfish.
But suggesting everyone operate on a substantially less privacy due to your specific desires for convenience seems... selfish. Not to mention, immoral - don't we all have a fundamental right to privacy?
A happy medium would be if as part of the location-granting prompt, you could tell the OS "just give a city-level fix— this app doesn't need to know exactly where I am".
Not every app -- but I feel like different apps demand different techniques, and tend to descend the gradient from most-intrusive to least in terms of permissions. That said, I'm not a privacy freak; I have no personal qualms about approving location services for a lot of apps. Go nuts, I don't care.
For instance, mapping or Waze needs your current GPS coordinate at all times. This doesn't bother me because I'm being tracked myriad other ways, even if I don't give permission -- cameras in every gas station and store, license-plate-reading cameras on police cars and traffic lights, StarLink in my Subaru, the SSID technique described in OP blog, credit card transactions at the pump, GPS coordinates from a passenger who did grant permissions (and we happen to be Instagram friends, so we're forever connected), an AirTag hidden in my gas tank, on and on and on.
It might seem like overreach for a paranoid person to need to grant location services to Papa Johns to order pizza, but that app may have legitimate reasons: expedited discovery of the nearest brick-and-mortar, realtime delivery tracking, order-abuse prevention or prediction (why are you placing orders repeatedly to locations all over the country, even if they're prepaid?), unwanted, craven marketing, backend revenue streams selling your data to Satan, etc.
Other types of apps, like Nextdoor or Tinder, don't actually need your exact location. They need to know generally where you are, but having precise coordinates isn't in the best interest of the user (see recent Feeld disaster where exact locations were prominently displayed on profiles [0]). On top of that, Nextdoor revolves around the neighborhood you live in; if you're traveling, it shouldn't update the feed based on your current location, nor let you join neighborhoods you're visiting in a transient manner just because of a GPS coordinate.
Then, consider that native-OS permissions popups are obtuse at best; many people simply want to have some tactile understanding of their choices.
My 70 year old father could understand if an app asks "Hey, generally where are you located? I'll send you coupons" and he can reply "XYZ, State" once, and that's the end of that. A boilerplate permissions modal that doesn't explain the difference between precise and approximate location, while simultaneously not visually showing what "approximate" even means (is it a loose radius centered on your precise location? how loose exactly? or is it a tile on a fixed grid? is it the entire city? etc) to him is no different than just constantly polling GPS+SSID in the background. "THEY know where I'm at!"
What I'm really getting at is most app permissions have terrible UX/UI, and operate opaquely.
It is not at all clear what you're sharing and with whom, and they tend to have three options: 0%, 1% and 100% (no access, access to one photo at a time when you choose, or access to every photo on your device; no location, give your location once and never be able to view what you submitted or update it, or precise location at all times, etc).
What if I only want to receive a specific segment of a brand's communications? (ex. let me know about upcoming events, but I'm not interested in new merch). Any bozo can implement that for an app that's willing to actively categorize their communications, but most have no interest in taking on the responsibility.
It's just a shame that users and user experience are rarely considered when designing most apps and websites. Corners are cut by design, liability is aggressively and intentionally limited from the top down, and decisions are made for structural and financial reasons at the expense of the humans wasting their time or money using any given app, when it could be so much better (with less effort!)
It's fascinating to me that "work from home" for many really means, "work from anywhere but the same place your coworkers are."
Comments about "separate buildings" and "renting office space" kind of underscores the real value wfh provides; less human interaction. The only problem with that is human interaction actually ends up making much work easier, not harder.
Separate building on the same property is still very much "from home"—you have no commute, can eat lunch with your family, could invite the dog in if you want, can do laundry during breaks, etc.
Renting office space less so, but it still provides another key benefit to remote work: you can live anywhere. Office space doesn't have to be in a high rise, it can be unused commercial space in a suburb or even in a small town.
If you don't like remote work that's fine, but there's not much point in posting your caricatures of remote work on a thread filled with people who enjoy working remotely.
It's hardly a caricature, when you realize that by working remotely, you're asking someone else to pay the costs of you not being in the room. Maybe for some it's fine, and that's what your manager can do for you, but if you're WFH and your whole team isn't, the cost is shifted to someone else.
But for workplaces that presume WFH is cost-free and all benefits, someone there is suffering on behalf of the people who WFH.
There’s plenty of costs the work in office crowd are shifting as well. Look at the hit the economy took from people not being prepared to work from home during a pandemic. Look at how offices inflate the prices of everything surrounding them and artificially force densification. Look at the environmental catastrophe office culture has caused through commuting.
The work in office crowd also forcibly shifts costs onto their coworkers by forcing them into the office under threat of firing, but the inverse never happens. I have a disability and had a legal entitlement to WFH for years which was routinely denied as a result of fraud where HR departments would claim undue hardship regardless of legitimacy. Since COVID this no longer flies as there is abundant proof that employers can in fact perform such accommodations trivially in many cases.
Work in office cost shifting was enforced through force and crime, so I have little sympathy for complaints of the costs of the work from home crowd voluntarily doing what they prefer to do.
"Work from office" is just "work". That's the default; you go somewhere, provide value in exchange for money, and go home. There was no "shifting" unless you mean pre-capitalistic agrarian societies where "work" meant doing literally everything yourself.
That's not how the history of work actually happened.
Specialization predates dedicated work spaces by millennia—the ancient Egyptians didn't "do literally everything themselves", they had quite sophisticated division of labor, with craftsmen regularly operating out of their homes. Even after people started receiving wages, work continued to be routinely done at home. It was less efficient to maintain a second space large enough for all your laborers than it was to just send them home with the materials they needed to get the job done, then have them come back with the finished product.
The industrial revolution changed that because now there were very expensive machines that were doing mostly actual work, and the people needed to be where those machines were. Once people were primarily interacting with ideas centralization still continued to be preferable because communication technology was limited.
COVID proved that the centralization is no longer necessary—our communication tech is sufficient to run an effective team distributed across the world, and very few jobs have the kind of large, expensive shared machinery that started the centralization process. There may still be preferences towards shared spaces, but those are personal preferences, they're no longer just the reality of work.
There was a 200 year window where centralization was a necessary feature of industrialization and knowledge work, but that era has come to an end, and it certainly wasn't long enough to become some sort of evolutionary fact of life!
Sorry but ancient Egyptians absolutely had dedicated workspaces separate from their homes. Obviously these places were more proximate to their homes insofar as their transportation methods limited the reasonable distances their workplaces could be, and a lack of zoning laws meant the intermingling of habitation spaces alongside these artisanal craftsmen you're referring to.
Further, this doesn't even disagree with my claim; what you've said here doesn't in any way support the claim that the "default" way of working was at home, and only "recently" did work centralize. Quite the opposite; work has always been "remote" in some sense. Even just practically, few people literally had the luxury to live exactly in the place where they worked, down to the room, as a great deal of work actually took place outside of any "room".
Additionally, COVID did not prove anything except that we can temporarily mitigate losses by working apart. Since, it's become very clear that such work styles create undue burdens on the folks who don't work remotely in order to support those who do, unless a company is entirely dedicated to remote work, which nearly none are.
I do go somewhere - I go to my home office. I have an entire formal written agreement which stipulates that I am to work from this location, and not other locations. If I’m stuck in a different city - tough luck - I need to haul ass back home.
This is a location where I have expended great effort in creating a productive and specialized workspace engineered to deal with personal medical issues largely using money out of my own pocket. I went to this expense, not just to benefit myself, but out of a sincere desire to be as productive as possible at my job.
Oh well if it's formal, that suddenly makes it totally okay and therefore nobody is paying for you to do that in extra effort...
My point is that in situations like yours, there's always a loser, and they often don't get a choice. You're benefitting, but the people you have an agreement with have passed the cost of keeping you in the loop and productive onto someone else, and that someone else can't decide to end remote work for you if the burden it too high.
Of course, SOMEBODY needs to at the very least needs to lay fiber-optics and rack networking gear to make remote work, work. I was one of those people for year. I was at one point the only person in a building full of servers. When I say the ONLY person, in a building of hundreds of people, I mean across departments, and I was paid a pittance extra for my service. The janitors would wish me good night and I would activate the alarm on my way out the door.
You can sure bet I worked my ass off to reduce that companies need for an on-site presence. It was also because one of my backups was disabled and I didn’t want to push that cost onto them. Another went for into a car accident and went on disability and it was bad enough that their personality changed when they came back. Shit fucking enraged me, I just did math in my head about how many employees my employer killed or maimed on the highways yearly with its forced office attendance policy and it was a decent number.
Of course, I respect the sacrifices of anybody doing such work and staying in the office so people can stay home.
Yet what we saw with on-premise work wasn’t that. What we saw was managers misappropriating company resources to have employees keep them company and make them feel important and follow them around to flex on their contemporaries. Who threw tantrums and threatened peoples livelihoods and broke disability accommodation laws to get their way. There are people who need to “come in to work” but it’s a LOT less than who was actually coming into work.
It's more like the constant coordination of disparate people, keeping those people motivated and aligned, making sure they're getting full access to all of the resources that would be otherwise trivial to provide to people collectively in an office.
And there's zero reason to believe that driving to work killed anyone. That's like saying being born killed people. The causes of people's car accidents are what killed them, not the reason they were driving.
Of course meeting in person can be a good way to deal with such concerns, but it doesn’t need to happen five times a week. Sometimes solving such problems just means sending an email.
There are also a significant number of companies that are remote only and successful and totally reject the need for this at all but of course - this won’t work for all workplaces or all workers. Just saying.
Are you one of those managers who insist on talking to me twice every day: "What are you doing right now?". Maybe treat people like grownups, not toddlers at least sometimes.
I'm in school full time, so no. The problem isn't that managers need to be able to check on employees, it's that everyone needs to be able to interact with one another face-to-face to optimally work, and when they can't, it's the people who manage them that actively suffer.
Maybe the tech will catch up to that, but it currently doesn't.
In a lot of cases in densely populated cities, commute each way is half an hour and people are paying tons for rent or mortgages in part because they want to be near their jobs.
Let's say your employee works 9-5, but really they start their commute at 8:30 and get home at 5:30 so it takes 9 hours. Imagine how much better some employees would perform with an extra hour of rest a day instead of essentially forcing them to drive because face to face interaction is awesome.
Some employees are literally not going to go to one meeting the entire day. They will drive. Sit at a desk. Talk to nobody. Then go home. It's a strange thing.
Also, just as there are people on tech who really thrive off the face to face interaction, there's a whole lot of people who got into technology BECAUSE they aren't good at face to face interactions.
People who got into tech because they're bad at human interaction will find no refuge working professionally. You're a burden to your company and your coworkers if you're in a role that requires coordination and you refuse to coordinate.
For roles that require little/no team coordination, it's acceptable to not work in the office most days. That isn't what a software developer job is, however, nor is it the vast majority of white-collar jobs generally.
Yes, you must commute. Yes, it takes time. But that's what the money is for. You wouldn't do this for free, so they compensate you for the inconvenience. The hour lost in a commute is infinitely made up for in the human interfacing that happens in person.
You sound like you think of yourself as a loser to remote work, but I assure you that in most cases there are not losers. My company is fully remote and we all choose to be here. No one is bearing any burden of the rest of us being remote because we all are remote and we structure our work accordingly.
I'm sorry your job sucks, but I suggest again: get another job. Wasting time telling other people in a completely different work environment how much your job sucks isn't going to persuade them that they're in the wrong.
This has nothing to do with my situation; I'm currently a full time student.
My observation is in general, not about any specific situation. Remote work has costs, and your leaders have decided those costs are better than the in-person costs. That's fine, and in a fully-remote environment it can work, but pretending like it's strictly "better" is unjustified.
We have NO IDEA how we’re going to maintain our current levels of energy usage even 100 years from now. We’ll run out of gas, run facefirst into global warming, and electrification with renewables will require a monumental amount of scarce resources and work.
We have a great solution to part of this problem. Move electrons, not people. Even if office culture really was all that and you’re right about everything, at the end of the day it doesn’t even matter because it’s unsustainable. We can’t move to solutions like electric self-driving cars fast enough, the electric co-worker MUST be part of the solution.
So I argue it doesn’t matter if remote is better. The costs of offices are increasing more and more and more and something had to give. It’s not if in office be remote work is better, the question is what benefits most form our limited abilities to work out of an office? Right now office culture is STILL running on borrowed time by having the commuters not pay for the externalities of their emissions. Of course on-site is important but that 5 day in the office culture was ALWAYS going to die.
Electrons can't yet sufficiently replicate the full experience of being in person for teams that still intend on having both, and what the electrons can't cover will be covered by someone, and that tends to be on someone who has no say about their newly added burden.
You talk as though most people who work from home are doing so as an exception to the rule— maybe that's how it is in your organization, but by now most companies have established official policies for WFH. Mine decided to go fully remote, others demanded a returned to the office, and others set up a hybrid system.
If your company landed somewhere on that spectrum that you're unhappy with, that sucks, but that suggests it's time to get a new job, not bitterly caricature your co-workers as only wanting to work remotely in order to avoid interacting with you.
For me, it's the commute that's unbearable. When I was younger, I'd move so that I could walk to work. Now I'm married, and own a house full of things, so that isn't really practical any longer. I'd still happily physically work anywhere that's within a short walk of my house.
"Work from home" is an unfortunately inaccurate label for "work from anywhere the f you want".
As for the whole muh'productivity, I feel like we've beaten this horse to death many times over the past few years. The only reasonable answer is: YMMV.
What’s not clear to me is why a corporation’s specific governance would matter. When a company “speaks”, it’s still an individual ultimately expressing themselves, just with the benefit of compensation.
The compelling argument is that it should be quite obvious that companies do not speak for all of their employees, cause most of them are - to what degree can be argued until the end of time - basically coerced to express the "opinion" of the company. At most it's the opinion of the owners, artificially amplified.
And to the question why the owners should not be able to express themselves: They can express themselves individually all they want, but if they want to use a company to do it they should also be personally responsible for everything the company does. And since one of the primary reasons to have a company is to isolate the owners from being sued personally ... there's a bit of a problem here.
But that’s not the claim. A “company” doesn’t speak, individuals do. Just because the individuals do as a result of compensation, doesn’t mean they lose their right to free expression.
You’re focusing on the “group” aspect of this, but that’s irrelevant to the argument. A PR spokesperson has individual rights, even if they choose to use that voice to advance a company’s goals.
Yes, and the reasoning holds; an individual decides to do that. There’s a name on that check, a specific person who authorizes the transfer of funds. How could you ethically stop a person from authorizing that check?
Disregarding the fact that I see many ways to ethically stop corruption, when an individual *acts* in the name of a corporation, the action is a result of the corporation's functioning, not of the individual's will (were it not so, the individual would have misappropriated the funds, to my understanding).
That’s what we’re discussing; I’m saying that an individual is protected in their speech while operating on behalf of a corporation, and that it’s not corruption. You declaring it so doesn’t make it so.
And yes, the individual risks acting in ways their company doesn’t like, but they can do things to lower that risk, such as asking other individuals within that corporation what their desired action is.
But it’s still individuals acting, so they’re afforded all of the protections the Constitution provides.
A better comment would attempt to explain why is my point. Thus far, you've been insistent on refusing to explain yourself or being open to alternative views.
That’s true, but it’s not what I said. It seems like you may need to reread what I wrote in order to respond to it, but then again it’s probably easier for you to pretend to misunderstand me than it is to actually address what I’ve written…
You've said over and over again how you don't want to talk about the subject, yet you keep replying. I'm just making sure people understand this isn't the strategy of someone who knows what they're talking about, and you're cooperating magnificently.
Honestly anyhow I have a distaste for US right of speech and its enormously broad interpretation, so I'm not too interested in debating its applications.
(I support the right to express your opinions, at most)
I also think that at the base of most US problems there's the freedom to corrupt politicians ("lobbying"), so, yeah, I really don't care much how legal it is
But you seem utterly incapable of justifying those beliefs to others...
Your beliefs are worthless to everyone else if you can't explain them, and no all you've done so far is declare what you believe to be correct, and have crumpled at the slightest sign of resistance. That demonstrates the weakness of your belief.
This isn’t a debate, this is me getting you to reveal how little weight you have behind what you believe.
This is useful because if anyone else reads this, they will get a pretty standard idea of how people who think like you can’t really justify their beliefs when challenged.
I do appreciate it, but I doubt you do. Easier to dismiss me and ignore any dissent, than it is to consider that you might actually be the bad guy here.
I told you this approach weakens your advocacy. Too bad you can’t listen.
I TRIED to debate the core of the issue, and you haven't read what I said.
This branch of the thread was just about a mention of some ideas that I have no intention to discuss right now.
Not that you offered any support for your ideas, other than "I think that my constitution says so".
If you're for freedom of companies corrupting politicians and politicians lying to everyone, you're free to be, maybe you're on the side who benefits from it.
I was hoping to have closed the discussion about eight messages ago, I'm not really here for this.
Morality is what separates us from animals. The suggestion right and wrong don’t exist is the real tyranny. It's what evil people say to do evil things.
If you can avoid managing authn, you will be substantially better off. I don't think you can so easily do this for authz; however, it depends on what you're building.