[{"data":1,"prerenderedAt":235},["ShallowReactive",2],{"project-13901005":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":18,"aspects":35,"strip":40,"post_text":42,"what":43,"said":70,"maker_in_thread":127,"shape":136,"grid":140,"attempts":199,"same_week":200,"maker_shows":33,"maker_hidden":227,"reader_version":228,"card":229},"13901005","Ladon","A Go Library for Better Access Control","title","Show HN: A Go Library for Better Access Control","https:\u002F\u002Fgithub.com\u002Fory\u002Fladon?branch=master","github.com","golangman",1489840416,2017,158,25,237,2242,11,"notable","dev_tools","access control library","library",[24,25,26,27,28],"access control","go library","authorization","iam policies","acl","debated",-0.105,{"positive":32,"neutral":32,"mixed":33,"critical":34},3,1,4,{"idea":36,"design":38},{"positive":37,"critical":34},2,{"positive":33,"critical":39},0,[41,32,41,32,39,39,32,39,33,39,33,33,32,39,39,39,39,39,41,39,39,33,39,39,39],5,null,{"problem":44,"audience":42,"pricing":42,"motivation":51,"time_to_build":42,"stack":55,"openness":68,"stage":69,"team_size":69},{"value":45,"source":46,"evidence":47},"Existing access control options are limited or hard to manage (RBAC, ACL, DAC)","maker",[48],{"id":49,"by":11,"text":50},"13901571","I have been there many many times. This is the reason for writing that library, because there are no good solutions that cover 99% of your cases. RBAC is limited, ACL is a…",{"value":52,"source":46,"evidence":53},"No good existing solutions covering most access control cases; liked AWS IAM policies",[54],{"id":49,"by":11,"text":50},[56],{"value":57,"source":58,"evidence":59},"Go","commenter",[60,64],{"id":61,"by":62,"text":63},"13901575","posnet","\"fine-grained access control in complex environments\" Oh that sounds... \"...is inspired by AWS IAM Policies.\" Oh god no. My day to day work is debugging IAM polices that have…",{"id":65,"by":66,"text":67},"13902157","7ewis","Can you recommend any resources to start learning Go?","open_source","unknown",{"praise":71,"objections":83,"requests":102,"questions":110,"alternatives":115},[72],{"value":73,"source":58,"evidence":74},"Good idea to have a reusable access control framework",[75,79],{"id":76,"by":77,"text":78},"13901249","caipre","Definitely going to be looking more into this. I am just about to start a project that needs ACLs, and I was surprised to find that I was going to have to write a solution…",{"id":80,"by":81,"text":82},"13902171","zackmorris","After implementing an ACL system with permissions inheritance for child nodes, I'm of the opinion that it's not really something that can be written by humans efficiently. Not to…",[84,95],{"value":85,"source":58,"evidence":86},"IAM-style policies are complex and easy to misconfigure",[87,88,91],{"id":61,"by":62,"text":63},{"id":89,"by":62,"text":90},"13901634","It almost always comes down to complexity. The inclusion of boolean logic in the policies is the root cause. Specifically, having not resources, or not principals and their…",{"id":92,"by":93,"text":94},"13901718","schlarpc","Just to give an example of the pain that can be caused by NotAction in practice: https:\u002F\u002Fwww.reddit.com\u002Fr\u002Faws\u002Fcomments\u002F3recc9\u002Fthis_iam_policy_did_not_do_what_i_thought\u002F This…",{"value":96,"source":58,"evidence":97},"Simple in-code permission registries may be enough",[98],{"id":99,"by":100,"text":101},"13901534","grey-area","I use a much smaller solution than this which just registers a list of permissions in memory of the form: role x can perform action y on resource z and then offers checks like…",[103],{"value":104,"source":58,"evidence":105},"Support LDAP for user storage",[106],{"id":107,"by":108,"text":109},"13901530","softwarelimits","LDAP is still the industry standard for storing user data, please support that.",[111],{"value":112,"source":58,"evidence":113},"Are there comparable established libraries?",[114],{"id":76,"by":77,"text":78},[116,123],{"value":117,"source":58,"evidence":118},"gorbac",[119],{"id":120,"by":121,"text":122},"13901647","weitzj","We are using https:\u002F\u002Fgithub.com\u002Fmikespook\u002Fgorbac right now, which works well for us. But we do not have any multi tenant requirements.",{"value":124,"source":58,"evidence":125},"Custom in-memory role-permission checks",[126],{"id":99,"by":100,"text":101},{"comments":34,"answered":33,"key":128},[129,130,133],{"id":49,"text":50},{"id":131,"text":132},"13901596","Why do those policies make it there in the first place? Could you share some scenarios? I'd love to improve the managibility of policies :) The hydra (…",{"id":134,"text":135},"13901560","Sorry, but if you had read the README you would probably have noticed that it does not matter if you use Google Auth, LDAP, MySQL or anything else. Subjects are just string…",{"commenters":137,"max_depth":41,"maker_replies":34,"first_comment_mins":138,"lifespan_hours":139},19,84,12,[141,143,145,147,149,150,152,154,157,159,160,161,162,166,170,173,174,177,180,184,187,190,191,193,197],[76,39,41,142,77,39],"project\u002Fpositive\u002Fidea",[99,39,32,144,100,39],"project\u002Fneutral\u002Fidea",[146,39,41,142,77,39],"13901557",[148,39,32,144,100,39],"13901586",[49,39,39,142,11,33],[120,39,39,151,121,39],"other\u002Fneutral\u002Fnone",[80,33,32,153,81,39],"project\u002Fmixed\u002Fidea",[155,33,39,151,156,39],"13904442","eternalban",[61,37,33,158,62,39],"project\u002Fcritical\u002Fidea",[131,37,39,144,11,33],[89,37,33,158,62,39],[92,37,33,158,93,39],[163,37,32,164,165,39],"13903600","project\u002Fneutral\u002Fdesign","dastbe",[167,37,39,168,169,39],"13902648","other\u002Fneutral\u002Fidea","jopsen",[171,32,39,151,172,39],"13903088","pebblexe",[65,34,39,151,66,39],[175,34,39,151,176,39],"13902751","spraak",[178,34,39,151,179,39],"13902769","mattbettinson",[181,34,41,182,183,39],"13902918","project\u002Fpositive\u002Fdesign","Goopplesoft",[185,34,39,151,186,39],"13903089","ereyes01",[188,34,39,151,189,39],"13903281","yandrypozo",[107,41,33,158,108,39],[134,41,39,192,11,33],"commenter\u002Fneutral\u002Fidea",[194,41,39,195,196,39],"13901862","commenter\u002Fneutral\u002Fnone","sk5t",[198,41,39,195,11,33],"13901924",[],[201,205,209,214,218,222],{"id":202,"name":203,"points":204,"category":20},"13907010","Aeneas",188,{"id":206,"name":207,"points":208,"category":20},"13906014","Klipse",111,{"id":210,"name":211,"points":212,"category":213},"13921364","Marta",106,"productivity",{"id":215,"name":216,"points":217,"category":20},"13908606","OS",97,{"id":219,"name":220,"points":221,"category":20},"13913413","go-sumtype",75,{"id":223,"name":224,"points":225,"category":226},"13920588","FaaS",73,"infrastructure",false,"v2",{"id":230,"name":5,"line":6,"ai":227,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":231,"top":18,"kw":232,"maker":11,"domain":10,"tier":19,"attempts":39,"strip":233,"url":9,"mix":234,"praise":73,"objection":85,"sub":21},13901005,-0.1,[24,25,26,27,28],"5353003010113000005001000",[32,32,33,34],1793990956661]