4 ms·

Here: https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-tokens https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web... https://news.ycombin

by atmosx 9y ago

Here: https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web-tokens https://storify.com/jcuid/thomas-h-ptacek-don-t-use-json-web... https://news.ycombinator.com/item?id=13866883 https://news.ycombinator.com/item?id=13866883 https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/ https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/ or go with the flow: https://www.google.gr/search?q=ptacek+jwt&oq=ptacek+jwt&aqs=chrome..69i57.2194j0j7&sourceid=chrome&ie=UTF-8 https://www.google.gr/search?q=ptacek+jwt&oq=ptacek+jwt&aqs=... He has countless comments preaching against JWT and DNSSEC. Mind you, I know the nickname, I know he is good with sec (I'd hire him to vet an app) and all but I don't know him IRL or ever heard of him before joining HN ... that's to say that he spent a lot of digital ink discussing these two topics here. The subset he's talking about, should amount for more than 50% of the regulars I guess.

zimpenfish 9y ago
The HN link doesn't explain why public key JWTs are bad; it's just more "don't use JWTs" (with the exceptionally unhelpful "as engineers, you need to understand first and foremost that JWT is bad". How can we understand if all we get is "JWT is bad because I say it is"?) The Storify link is slightly more useful but again doesn't really explain anything - it's just bullet points of "I think these things are bad in a standard" which is great if you already have the knowledge of those things. Utterly useless otherwise. And if "implementation errors should lower your opinion of a specification" means we shouldn't use JWT, where does that leave us on WIFI, SSL, HTTP, speculative execution in pipelines, ...?
- tptacek 9y ago
  To me, this rebuttal reads, "I don't understand it, ergo it must be dubious". I'm criticizing JWT. Not you, or any other developer. If you don't understand or follow or agree with my criticism, that's OK. We can still live our lives.
  - zimpenfish 9y ago
    > To me, this rebuttal reads, "I don't understand it, ergo it must be dubious". That is not intended - it's more "I don't understand it, I'm happy to believe it's broken but all we get is Appeal To (self)Authority as to why rather than actual usefulness." > If you don't understand or follow or agree with my criticism, that's OK. We can still live our lives. Well, sure, but wouldn't you prefer to help people who don't understand by actually explaining something for once?

by atmosx 9y ago

zimpenfish 9y ago

The HN link doesn't explain why public key JWTs are bad; it's just more "don't use JWTs" (with the exceptionally unhelpful "as engineers, you need to understand first and foremost that JWT is bad". How can we understand if all we get is "JWT is bad because I say it is"?) The Storify link is slightly more useful but again doesn't really explain anything - it's just bullet points of "I think these things are bad in a standard" which is great if you already have the knowledge of those things. Utterly useless otherwise. And if "implementation errors should lower your opinion of a specification" means we shouldn't use JWT, where does that leave us on WIFI, SSL, HTTP, speculative execution in pipelines, ...?

tptacek 9y ago
To me, this rebuttal reads, "I don't understand it, ergo it must be dubious". I'm criticizing JWT. Not you, or any other developer. If you don't understand or follow or agree with my criticism, that's OK. We can still live our lives.
- zimpenfish 9y ago
  > To me, this rebuttal reads, "I don't understand it, ergo it must be dubious". That is not intended - it's more "I don't understand it, I'm happy to believe it's broken but all we get is Appeal To (self)Authority as to why rather than actual usefulness." > If you don't understand or follow or agree with my criticism, that's OK. We can still live our lives. Well, sure, but wouldn't you prefer to help people who don't understand by actually explaining something for once?