4 ms·

People outsource auth to a specialised company (okta) and they outsource tier-1/2 support to a specialised company (because they are a multi-tenant B2B SaaS co.

People outsource auth to a specialised company (okta) and they outsource tier-1/2 support to a specialised company (because they are a multi-tenant B2B SaaS co.) If this were not a SaaS product, instead was a well-tested, audited and certified software package that was bought and run in-house by FTEs (and audited periodically), this additional complexity could have been avoided and this breach would have been much harder. As an industry I don't know if we have made rational choices along the way.

emteycz 5y ago
As an industry, we have abundance of choice. You're not practically nor theoretically locked to SaaS vendors - there are equally good self-hosted open source auth solutions. A portion of our industry seems to be bad at risk calculation, but that's not inherent to the SaaS model - this app very well could've been made with strictly separated tenants.
- gnz11 5y ago
  Realistically though we are often locked into terrible software that no one wants because a SVP was wined and dined by the vendor.
sofixa 5y ago
For most companies, hiring good quality FTEs is complicated, and very expensive. It makes sense, in many cases, to delegate some things to external vendors ( SaaS companies). There is a line to be drawn somewhere, and it will vary between companies and industries - e.g. a tech company could probably easily handle auth in-house, while i wouldn't expect a law firm or whatever to handle that ( and i wouldn't want them to).
- maxerickson 5y ago
  Yeah, it's not surpising at all that someone managed to build a business selling auth for less than hundreds of thousands of dollars a year.
- entropea 5y ago
  Probably a lot cheaper than the fire pit they just walked into.
  - epicide 5y ago
    In the long run, yes. But people are often promoted mostly based on short term impacts. Especially visible ones. e.g. nobody got a promotion because the change they pushed for 5 years ago prevented an attack today. That's not to say people are just greedy and only chase what gets them a promotion, but replace "promotion" with "received positive feedback".
- game_the0ry 5y ago
  > For most companies, hiring good quality FTEs is complicated, and very expensive. This is cope - managers repeat this narrative so they can blame some other factor rather than having to put in the work to fix the problem of hiring good FTEs. Unfortunately, this narrative has been repeated so often that it is perceived to be axiomatic, which is why it is repeated without any criticism. No, its not that hard to find good FTEs, you just haven't tried hard enough, or you're not paying enough, or your glassdoor reviews are bad.
  - cupofpython 5y ago
    >or you're not paying enough this is not a negligible barrier. Sure you could argue that a business that isnt successful enough to hire for that expensive FTE maybe shouldnt exist at all, but a lot more is possible by being able to outsource it. And there really isnt a good reason why it cannot be outsourced from an operations standpoint - it is entirely a security problem. It's not like auth is hard to do for a third party.
api 5y ago
JavaScript is the most popular language. We have not made rational choices at all.
ricardobayes 5y ago
Definitely not and it will hit us big time imho. We are one freak incident away from abandoning npm/pypi completely and completely re-thinking how libraries are being done/used.
lupire 5y ago
If Okta can't hire competent staff and build a secure environment, how can you expect every other company in the world to do so? > well-tested, audited and certified software package Who is selling this?
- shahbaby 5y ago
  To be fair to Okta, nothing is ever 100% secure.
  - DyslexicAtheist 5y ago
    that is such a lazy statement

emteycz 5y ago

As an industry, we have abundance of choice. You're not practically nor theoretically locked to SaaS vendors - there are equally good self-hosted open source auth solutions. A portion of our industry seems to be bad at risk calculation, but that's not inherent to the SaaS model - this app very well could've been made with strictly separated tenants.

gnz11 5y ago
Realistically though we are often locked into terrible software that no one wants because a SVP was wined and dined by the vendor.

sofixa 5y ago

For most companies, hiring good quality FTEs is complicated, and very expensive. It makes sense, in many cases, to delegate some things to external vendors ( SaaS companies). There is a line to be drawn somewhere, and it will vary between companies and industries - e.g. a tech company could probably easily handle auth in-house, while i wouldn't expect a law firm or whatever to handle that ( and i wouldn't want them to).

maxerickson 5y ago
Yeah, it's not surpising at all that someone managed to build a business selling auth for less than hundreds of thousands of dollars a year.
entropea 5y ago
Probably a lot cheaper than the fire pit they just walked into.
- epicide 5y ago
  In the long run, yes. But people are often promoted mostly based on short term impacts. Especially visible ones. e.g. nobody got a promotion because the change they pushed for 5 years ago prevented an attack today. That's not to say people are just greedy and only chase what gets them a promotion, but replace "promotion" with "received positive feedback".
game_the0ry 5y ago
> For most companies, hiring good quality FTEs is complicated, and very expensive. This is cope - managers repeat this narrative so they can blame some other factor rather than having to put in the work to fix the problem of hiring good FTEs. Unfortunately, this narrative has been repeated so often that it is perceived to be axiomatic, which is why it is repeated without any criticism. No, its not that hard to find good FTEs, you just haven't tried hard enough, or you're not paying enough, or your glassdoor reviews are bad.
- cupofpython 5y ago
  >or you're not paying enough this is not a negligible barrier. Sure you could argue that a business that isnt successful enough to hire for that expensive FTE maybe shouldnt exist at all, but a lot more is possible by being able to outsource it. And there really isnt a good reason why it cannot be outsourced from an operations standpoint - it is entirely a security problem. It's not like auth is hard to do for a third party.

api 5y ago

JavaScript is the most popular language. We have not made rational choices at all.

ricardobayes 5y ago

Definitely not and it will hit us big time imho. We are one freak incident away from abandoning npm/pypi completely and completely re-thinking how libraries are being done/used.

lupire 5y ago

If Okta can't hire competent staff and build a secure environment, how can you expect every other company in the world to do so? > well-tested, audited and certified software package Who is selling this?

shahbaby 5y ago
To be fair to Okta, nothing is ever 100% secure.
- DyslexicAtheist 5y ago
  that is such a lazy statement