BuzzFeed SSO
Security and privacy
identity aware proxy
SHOW HN2018
How HN took it
3 positive, 9 neutral or asking, 0 mixed, 1 critical, out of 13 comments about the project. Thread score +0.08.
Docs: 2 for, 0 againstPrivacy: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Documentation and quick-start guides appreciated
From 1 comment
Thank you for not having just dumped it like that, but adding quick-start guides, examples and even did some additionnal security checks, it's just awesome for little…
Signez on HN
Security review by outside firm and bug bounty
From 2 comments
Thank you for not having just dumped it like that, but adding quick-start guides, examples and even did some additionnal security checks, it's just awesome for little…
Signez on HNThis is mentioned in the article > In preparation for open sourcing we also engaged with Security Innovation, a widely respected agency who count Microsoft, Symantec, and Amazon…
kingbirdy on HN
Objections
Security assessment lasted only one week
From 1 comment
It was only a week long assessment though, I don’t know Security Innovation but I’m sure they would have appreciated more time.
baby on HN
OAuth2 rationale over SAML was questioned
From 2 comments
IMO That's opposite of what I understand. The selling point of Oauth2 is SAML works great on web (mobile browsers included) but not so on apps.
nancyp on HNThat doesn't make sense. SAML is only a bunch of POST and redirections as far as the browser is concerned. There is no specific support required from the browser.
user5994461 on HN
Requests
Support for additional OAuth2 providers beyond Google
From 1 comment
Looks super interesting. I'm looking to do something like this for my personal stuff, but I'd rather avoid the dependency on Google. Does anyone have suggestions for how to set…
markovbot on HN
Better documentation
From 1 comment
thank you - We know from our own experience using other open source projects that having documentation, and guides to get started really helps. We know there is more to do there…
itwasntandy on HN
Questions
Pen-testing by an independent company?
From 1 comment
Have you contracted an independent pen-testing company to assess your design and implementation?
andremat on HN
Why not Keycloak?
From 1 comment
Neat project, but I have to ask why you didn't go with an existing solution like Keycloak?
snuxoll on HN
Works with Nginx auth_request?
From 1 comment
Is it possible to use this with Nginx auth_request? I use bitlys oauth2_proxy like so because it doesn't support websockets.
ashayh on HN
Alternatives named
Keycloak
From 1 comment
Neat project, but I have to ask why you didn't go with an existing solution like Keycloak?
snuxoll on HN
Google Cloud IAP
From 1 comment
a bit ignorant in this area, but how is this functionally different than Google Cloud IAP?
rllin on HN
traefik-forward-auth
From 1 comment
We took a slightly different approach to solving a similar problem: https://github.com/thomseddon/traefik-forward-auth We were already using traefik as a proxy for our…
thomseddon on HN
bitly oauth2_proxy
From 1 comment
I have used https://github.com/bitly/oauth2_proxy with success, and it supports a variety of providers.
wrboyce on HN