Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Nice!

    I'd like to fix the prior abstract. Auth and auth upsets me greatly cos we have:

    Authentication & Authorization

    and we call both/either auth. Hence please help me make this a thing:

    AuthENTIcation & AuthORIzation : ENTI & ORI

    ENTI- can you enter, ORI (or ORIZ) what can you do?

    by Quarrelsome
  • ident and perms
    by andai
  • ENTIC and ORIZ would make more orthographic sense...

    or 4entic5 and 4oriz5, inverting the k8s, i18n pattern...

    pronounced "forentics" and "forizes"...

    somebody stop me!

    by nicwolff
  • > ENTI- can you enter, ORI (or ORIZ) what can you do?

    I don't mean to quarrel about it, but I understood Authentication to be closer to identification. To provide "adequate proof that you are actually who you claim to be".

    Even the "can you enter" question falls under authorization; "does the user have appropriate permissions?" Entering is just one of perhaps many subsequent levels of permissions.

    by lozf
  • Sign in / Sign up is my go to pet peeve for this type of thing
    by rrr_oh_man
  • This has already been solved well-enough with AuthN and AuthZ as distinct names.
    by hobofan
  • “It’s worth being honest about…” yeah, no.
    by zbentley
  • https://xkcd.com/927

    Nice work and all regardless

    by usernametaken29
  • Another take I like is "The good thing about standards is there are many to choose from!"
    by bayindirh
  • Is the article inventing any new words?
    by whazor
  • Quite literally the first thing that jumped to my mind when I read the title
    by aneutron
  • excellent article, very thorough and nuanced explanation.
    by bijowo1676
  • Thanks!
    by andychiare
  • turns out naming is important
    by tuberreact
  • And renaming things is hard, if not impossible
    by ithkuil
  • I'm maintaining a document called Tricksy words with multiple meanings that cause endless confusion and strife

    Just in the past year I have wasted several months pulling my hair out due to incorrectly named projects.

    It really does turn out naming is important!

    by andai
  • > can this subject perform this action on this object?

    IMHO, the most elegant method to answer this question is capability based access control. If the subject can utter the action, then it can perform it. And then delegation is the transfer of nouns and verbs to perform the utterances.

    by black_knight
  • I have more experience with authorization than most engineers, even engineers who have some experience with authn/authz, and I have no idea what that "subject can utter the action" or "transfer of nouns and verbs to perform the utterances" could mean
    by williamdclt
  • Even that is oversimplified. To launch nuclear-armed ICBMs, it takes to subjects to turn two keys separated by sufficient distance that no one person can turn both keys at the same time. In many cases, specially involving sysadmins, you want a quorum so a rogue sysadmin cannot lock others out or commit other destructive actions.
    by fmajid
  • > If the subject can utter the action, then it can perform it.

    This sounds like another layer of weird terminology that doesn't mean anything for someone who is not familiar with whatever capability system you're thinking of.

    Say I am a user who can see a particular directory on a shared setup. I try to upload a file in this directory, using the same method that worked on another directory. The question of AuthZ is: will I be allowed to do it or not? In the plain sense of the words, I can absolutely "utter the action", I have all of the "verbs" (upload) and "nouns" (the file, the destination path). Still, I should not be allowed to perform the action if I was only given read-only access here.

    Now sure, you can say that "upload to dirA" is a different verb than "upload to dirB". But this is just confusing terminology, it doesn't enlighten anything.

    by simiones
  • Usually vendors fight over terminology because they want to "own" a portion of mindspace. Ultimately authorization is a programming problem, and people have devised very complicated declarative solutions like Google Zanzibar to avoid biting the bullet.
    by fmajid
  • Unclosable cookie banner. Top notch website engineering.
    by andrewshadura
  • It’s about 20% of the vertical screen space on an iPhone, maddening.
    by 010101010101
  • I see no banner, but I use an ad blocker configured to reject and hide all such banners, like a sane person.
    by aleqs
  • Would you like cookies? (No) -> You can revoke consent at any time (Revoke) -> Would you like cookies?
    by zero_shift
  • Are you fixing it at the IETF and RFC level, or is this just another way to say "BUY OUR SHIT AND IT TOTALLLY SOLVES EVERYTHING!!!!11"
    by nekusar
  • I love how the OIDC standard is littered with “authentication identity token code id cookie identifier” and many subtle variations of homonyms in slightly different combinations and orders.

    I’m sure someone thought it all made perfect sense.

    Probably someone who never confuses “empathy” and “sympathy” while also carefully distinguishing between “should” and “ought”.

    by jiggawatts
  • > Probably someone who never confuses “empathy” and “sympathy” while also carefully distinguishing between “should” and “ought”.

    What do you mean by this?

    by theasisa