14 ms·

> Did you know that each time you log into Facebook, check your email or fire up Candy Crush, a software engineer has thought about user registration and authen

> Did you know that each time you log into Facebook, check your email or fire up Candy Crush, a software engineer has thought about user registration and authentication. It's a bad sign when the very first sentence of your promotional blogpost has no coherent meaning in the English language. > I am quite sure that if your application actually grew that quickly the rest of your infrastructure would fail spectacularly. But rest assured, Passport will be just fine. Another thing about writing promotional blogposts: don't belittle your potential clients.

brianwawok 10y ago
I am trying to figure out the use case of login as a service. There obviously is one, but I am having trouble thinking of it. Clearly login means something different to each app, right?
- brokenwren 10y ago
  The registration and login parts are usually the simple features to implement. Its the localization, emailing, password encryption, disciplining, rewards, two-factor authentication, OAuth, login reporting, registration reporting, daily active users reports, and monthly active users reports that are the more challenging features to build yourself. Almost every application needs all of these features, but very few have them because they take so long to code.
  - brianwawok 10y ago
    So encryption, emailing, oauth... DJango or another modern framework does all of that out of the box or with a plugin. Login reporting is cool... But if you build your own you can get full app reporting. Not sure of the exact value add but I would way rather have reporting on all pages not just login. Localization? The hard part is translating my entire app. Not sure if I do that work, I'm going to be mad I have to translate the word login and logout
    - robotdan 10y ago
      I know that I've found that above the base features that many frameworks provide such as DJango - if you start pulling the thread on features like forgot password / reset password - I quickly find there is a lot of coding to be done. Click reset, store a unique id, send the user an email with a link including the unique id, verify that ID on the request and then allow a password change. Then to be secure that unique id needs to be timed out once it is generated to ensure the link is only good for a short period of time, etc. Not to say anyone couldn't code all of that, but some of the simple features once fully thought out end up being fairly complex. In my experience many of the out of the box options still need to be extended to be fully realized for enterprise usage. I don't have a ton of experience with DJango specifically so I could be mistaken - perhaps it does more than I know.
- smuss77 10y ago
  I'm thinking separating user auth (and details required) with something like this from user domain data would drastically reduce the likelihood that one hack could compromise everything all at once.
  - brianwawok 10y ago
    The old scatter your seeds and hope approach? I think adding more systems increases your odds of being hacked, even if slightly lowering the damage of one hack. I would kinda prefer to avoid hacked all together.
GFK_of_xmaspast 10y ago
That sentence is a little awkward but I'm not seeing anything horrible about it. (Surely you're not complaining that there should be a "?" at the end?) I stuck it into the Stanford NLP parser ( http://nlp.stanford.edu:8080/parser/index.jsp http://nlp.stanford.edu:8080/parser/index.jsp ) and the output matched my prior reckons.
- mfoy_ 10y ago
  Perhaps it's just wrong? A software engineer doesn't think about user authentication and encryption every time someone logs in to any popular service. That would be silly, and impossible. I mean, maybe it's just being hyperbolic Or maybe it is just supposed to mean that a software engineer had to think about, and set up, the login system for each system you log in to at some point.
  - morgante 10y ago
    Technically, it's trivially true. Of course a software engineer has at some point "thought about user registration and authentication." I presume that's what it's going for, but all in this is one of the worst promotional blog posts I've ever read.
    - mfoy_ 10y ago
      I was being generous and assuming they meant "every time a user logs in, a software engineer thinks about security" because the alternative is literally meaningless. To elaborate, statements like "every time you shake hands with someone, a volcano has erupted" are equally, trivially, true. They just don't mean anything-- anything at all. There exists some volcano which has erupted. Therefore any time you shake hands with someone, eat a meal, go to sleep, push a button, etc... that statement is still true, just like it was and would be with or without your entire existence. At which point you're just saying words to hit some word count or something. Or maybe allude to some unstated connection... ?
  - GFK_of_xmaspast 10y ago
    I wasn't addressing its truthiness, just responding to the claim that it "has no coherent meaning in the English language".
robotdan 10y ago
Interesting take. I didn't see this as a put down of any potential client but more to say it is difficult to grow so quickly. Imagine the load on game servers if you grew to 125 million users over a weekend, this load is considerably different than that of an authentication server.
brokenwren 10y ago
I don't see this as belittling customers or incoherent at all. I'm pretty sure every engineer has thought about these issues before and we've all seen spectacular crashes from load. I think the idea of the article is that user registration and login isn't as simple to scale as everyone thinks it is.

brianwawok 10y ago

I am trying to figure out the use case of login as a service. There obviously is one, but I am having trouble thinking of it. Clearly login means something different to each app, right?

brokenwren 10y ago
The registration and login parts are usually the simple features to implement. Its the localization, emailing, password encryption, disciplining, rewards, two-factor authentication, OAuth, login reporting, registration reporting, daily active users reports, and monthly active users reports that are the more challenging features to build yourself. Almost every application needs all of these features, but very few have them because they take so long to code.
- brianwawok 10y ago
  So encryption, emailing, oauth... DJango or another modern framework does all of that out of the box or with a plugin. Login reporting is cool... But if you build your own you can get full app reporting. Not sure of the exact value add but I would way rather have reporting on all pages not just login. Localization? The hard part is translating my entire app. Not sure if I do that work, I'm going to be mad I have to translate the word login and logout
  - robotdan 10y ago
    I know that I've found that above the base features that many frameworks provide such as DJango - if you start pulling the thread on features like forgot password / reset password - I quickly find there is a lot of coding to be done. Click reset, store a unique id, send the user an email with a link including the unique id, verify that ID on the request and then allow a password change. Then to be secure that unique id needs to be timed out once it is generated to ensure the link is only good for a short period of time, etc. Not to say anyone couldn't code all of that, but some of the simple features once fully thought out end up being fairly complex. In my experience many of the out of the box options still need to be extended to be fully realized for enterprise usage. I don't have a ton of experience with DJango specifically so I could be mistaken - perhaps it does more than I know.
smuss77 10y ago
I'm thinking separating user auth (and details required) with something like this from user domain data would drastically reduce the likelihood that one hack could compromise everything all at once.
- brianwawok 10y ago
  The old scatter your seeds and hope approach? I think adding more systems increases your odds of being hacked, even if slightly lowering the damage of one hack. I would kinda prefer to avoid hacked all together.

GFK_of_xmaspast 10y ago

That sentence is a little awkward but I'm not seeing anything horrible about it. (Surely you're not complaining that there should be a "?" at the end?) I stuck it into the Stanford NLP parser ( http://nlp.stanford.edu:8080/parser/index.jsp http://nlp.stanford.edu:8080/parser/index.jsp ) and the output matched my prior reckons.

mfoy_ 10y ago
Perhaps it's just wrong? A software engineer doesn't think about user authentication and encryption every time someone logs in to any popular service. That would be silly, and impossible. I mean, maybe it's just being hyperbolic Or maybe it is just supposed to mean that a software engineer had to think about, and set up, the login system for each system you log in to at some point.
- morgante 10y ago
  Technically, it's trivially true. Of course a software engineer has at some point "thought about user registration and authentication." I presume that's what it's going for, but all in this is one of the worst promotional blog posts I've ever read.
  - mfoy_ 10y ago
    I was being generous and assuming they meant "every time a user logs in, a software engineer thinks about security" because the alternative is literally meaningless. To elaborate, statements like "every time you shake hands with someone, a volcano has erupted" are equally, trivially, true. They just don't mean anything-- anything at all. There exists some volcano which has erupted. Therefore any time you shake hands with someone, eat a meal, go to sleep, push a button, etc... that statement is still true, just like it was and would be with or without your entire existence. At which point you're just saying words to hit some word count or something. Or maybe allude to some unstated connection... ?
- GFK_of_xmaspast 10y ago
  I wasn't addressing its truthiness, just responding to the claim that it "has no coherent meaning in the English language".

robotdan 10y ago

Interesting take. I didn't see this as a put down of any potential client but more to say it is difficult to grow so quickly. Imagine the load on game servers if you grew to 125 million users over a weekend, this load is considerably different than that of an authentication server.

brokenwren 10y ago

I don't see this as belittling customers or incoherent at all. I'm pretty sure every engineer has thought about these issues before and we've all seen spectacular crashes from load. I think the idea of the article is that user registration and login isn't as simple to scale as everyone thinks it is.