6 ms·

I'm probably not the main audience for this, but if you mention security as a top-level feature it might be good to fix these: https://securityheaders.com/?q=h

I'm probably not the main audience for this, but if you mention security as a top-level feature it might be good to fix these: https://securityheaders.com/?q=https%3A%2F%2Fclerk.dev https://securityheaders.com/?q=https%3A%2F%2Fclerk.dev https://securityheaders.com/?q=https%3A%2F%2Fdashboard.clerk.dev https://securityheaders.com/?q=https%3A%2F%2Fdashboard.clerk... For me it is also a red flag to include third party CDN JS (especially without SRI) on security critical applications (like the login for the dashboard and customer logins do with jsdelivr).

QUFB 6y ago
It's not an especially good look, although I see in the past few minutes HSTS has been enabled!
- SahAssar 6y ago
  It's the same as before, clerk.dev does not have it and dashboard.clerk.dev had HSTS when I checked first too. HSTS is sorta irrelevant for .dev though since all of .dev is on the preload list in major browsers. I'd be more worried about the third party JS without SRI. Especially since including third party JS is an active choice while not having headers is an inactive one.
colinclerk 6y ago
Thank you for calling out the headers. We'll work to resolve right away. And agreed on the CDN JS. We'll move these assets to the customer's domain.
- qwantim1 6y ago
  It’s a great idea, but your company is going to be a serious target. You not only will have the ability to control authN, but you’ll own authR also if you’re managing users and groups. You’ll also own all the conference rooms, printers, servers, etc., since you’ll be hosting Active Directory for the Windows folk... at least that’s how I’d understand user management for auth.
  - SahAssar 6y ago
    Is authR another way to say authZ? I've never heard of authR and a quick google seems to mostly show a cloudflare project and stuff related to the term "author".
    - thingsgoup 6y ago
      I took it to mean authz. Never seen authR before either.
      - afrodc_ 6y ago
        It seems to be the new way to say it. I've known both as AuthN and AuthZ but AuthR picked up for some reason or another. In the same vein, it seems like a lot of people aren't too aware of the "identity" space so there's a whole lot of re-inventing the wheel with external sources not realizing something already exists.
    - arunaugustine 6y ago
      I think authN is Authentication and authR is authorisation. Two related but slightly different concepts. The third of the trio is Accounting which completes the AAA, the family of protocols that mediate access on the internet [0] [0]: https://en.wikipedia.org/wiki/AAA_(computer_security) https://en.wikipedia.org/wiki/AAA_(computer_security) edit: added reference and context for completion.
markdown 6y ago
> For me it is also a red flag to include third party CDN JS Why anyone would use third party js for anything other than dev work is beyond me. Are people really building websites that can serve html, images, and css, but not js?
- hn_throwaway_99 6y ago
  There was the use case at one point that serving a version of a popular 3rd party JS framework from a CDN would result in the likelihood of that file being able to be served from the browser's cache, because there would be a decent chance the end user had visited some other site that used the same popular framework. That no longer works, see https://www.stefanjudis.com/notes/say-goodbye-to-resource-caching-across-sites-and-domains/ https://www.stefanjudis.com/notes/say-goodbye-to-resource-ca... and https://developers.google.com/web/updates/2020/10/http-cache-partitioning https://developers.google.com/web/updates/2020/10/http-cache...
- XCSme 6y ago
  I think that most 3rd party providers say "DON'T HOST THIS FILE LOCALLY AS IT WILL BREAK WHEN WE MAKE UPDATES".
  - markdown 6y ago
    Which of course makes no sense. Why would any action they take have anything to do with a website that isn't hosting their files.
    - XCSme 6y ago
      Well, if the JS is to connect to an end-point on their server (eg. Google Analytics) if they remove/deprecate the old API the JS file won't work anymore as it might not be compatible with the new API, so the JS file would have to be updated.
      - markdown 6y ago
        Oh sure! I guess we're talking about different things. In your example, Google is providing you a service, and they're serving the file. I was talking about using 3rd party file hosting services like cdnjs.com and unpkg.com It's gotten so bizarre that highly popular libs (even Facebook's React!!! )will recommend you hotlink these third party sites rather than give you a zip file to download and host yourself.
presentation 6y ago
Also eyeballing the team, looks like nobody in particular has a security background. Worrisome...

QUFB 6y ago

It's not an especially good look, although I see in the past few minutes HSTS has been enabled!

SahAssar 6y ago
It's the same as before, clerk.dev does not have it and dashboard.clerk.dev had HSTS when I checked first too. HSTS is sorta irrelevant for .dev though since all of .dev is on the preload list in major browsers. I'd be more worried about the third party JS without SRI. Especially since including third party JS is an active choice while not having headers is an inactive one.

colinclerk 6y ago

Thank you for calling out the headers. We'll work to resolve right away. And agreed on the CDN JS. We'll move these assets to the customer's domain.

qwantim1 6y ago
It’s a great idea, but your company is going to be a serious target. You not only will have the ability to control authN, but you’ll own authR also if you’re managing users and groups. You’ll also own all the conference rooms, printers, servers, etc., since you’ll be hosting Active Directory for the Windows folk... at least that’s how I’d understand user management for auth.
- SahAssar 6y ago
  Is authR another way to say authZ? I've never heard of authR and a quick google seems to mostly show a cloudflare project and stuff related to the term "author".
  - thingsgoup 6y ago
    I took it to mean authz. Never seen authR before either.
    - afrodc_ 6y ago
      It seems to be the new way to say it. I've known both as AuthN and AuthZ but AuthR picked up for some reason or another. In the same vein, it seems like a lot of people aren't too aware of the "identity" space so there's a whole lot of re-inventing the wheel with external sources not realizing something already exists.
  - arunaugustine 6y ago
    I think authN is Authentication and authR is authorisation. Two related but slightly different concepts. The third of the trio is Accounting which completes the AAA, the family of protocols that mediate access on the internet [0] [0]: https://en.wikipedia.org/wiki/AAA_(computer_security) https://en.wikipedia.org/wiki/AAA_(computer_security) edit: added reference and context for completion.

markdown 6y ago

> For me it is also a red flag to include third party CDN JS Why anyone would use third party js for anything other than dev work is beyond me. Are people really building websites that can serve html, images, and css, but not js?

hn_throwaway_99 6y ago
There was the use case at one point that serving a version of a popular 3rd party JS framework from a CDN would result in the likelihood of that file being able to be served from the browser's cache, because there would be a decent chance the end user had visited some other site that used the same popular framework. That no longer works, see https://www.stefanjudis.com/notes/say-goodbye-to-resource-caching-across-sites-and-domains/ https://www.stefanjudis.com/notes/say-goodbye-to-resource-ca... and https://developers.google.com/web/updates/2020/10/http-cache-partitioning https://developers.google.com/web/updates/2020/10/http-cache...
XCSme 6y ago
I think that most 3rd party providers say "DON'T HOST THIS FILE LOCALLY AS IT WILL BREAK WHEN WE MAKE UPDATES".
- markdown 6y ago
  Which of course makes no sense. Why would any action they take have anything to do with a website that isn't hosting their files.
  - XCSme 6y ago
    Well, if the JS is to connect to an end-point on their server (eg. Google Analytics) if they remove/deprecate the old API the JS file won't work anymore as it might not be compatible with the new API, so the JS file would have to be updated.
    - markdown 6y ago
      Oh sure! I guess we're talking about different things. In your example, Google is providing you a service, and they're serving the file. I was talking about using 3rd party file hosting services like cdnjs.com and unpkg.com It's gotten so bizarre that highly popular libs (even Facebook's React!!! )will recommend you hotlink these third party sites rather than give you a zip file to download and host yourself.

presentation 6y ago

Also eyeballing the team, looks like nobody in particular has a security background. Worrisome...